Wachovia Corporation 2006 RISK ASSESSMENT

Central Point of Contact: Richard F. Westerkamp, Jr.

Team Members: Stan Poszywak, Deputy CPC and Operational Risk John Beebe, Market Risk Nancy Stapp, Credit Risk Ryan Rehom, Interest Rate Risk and Liquidity Risk Jeremy Carter, Legal and Compliance Risk Jim Gearhart, Information Technology (IT) Kevin Littler, Financial Analyst

Shared Support: Craig Frascati, Basel II Danny Elder, Market Risk Al Morris, Market Risk Ron Bertolini, Market Risk Kirit Chokshi, Fiduciary Risk Karen Craigmile, Operational Risk Phil Watts, IT Jeremy Caldwell, Principal Investing Steven Pesek, Payment Systems Risk

Last Update: July 27, 2006

CONFIDENTIAL FCIC-134446 Restricted - F.R. Table of Contents

page

I. Institutional Overview 3

II. Risk Assessment Summary 20

Consolidated Executive Summary

• Overall Summary Assessment of Inherent Risk 20 o Inherent Risk by Type • Overall Summary Assessment of Risk Management 23 o Risk Management and Controls o Risk Management by Type

III. Detailed RAP Documentation 28

Credit Risk 28 Market Risk • Trading Book 45 • Banking Book 69 Liquidity Risk 83 Operational Risk 95 Legal and Compliance III

IV. Risk Matrices and Institutional Overview Appendix Items 124

2006 Risk Matrices Appendix Items (Business Line Management)

CONFIDENTIAL FCI C-13444 7 Restricted - F.R. I. Institutional Overview

Executive Summary

Wachovia Corporation (Wachovia) is the fourth-largest financial holding company in the United States, formed by the 2001 merger of the former First Union Corporation of Charlotte, North Carolina and former Wachovia Corporation of Winston-Salem, North Carolina. Wachovia is a multi-state, multi-bank holding company with consolidated total assets of $542 billion as of March 31, 2006. Relative to its peers, its banking operations emphasize commercial lending with 55% ofthe $281 billion loan book being commercial loans. The corporation operates full service retail banking offices in fifteen states and the District of Columbia, making it the largest retail banking franchise on the East Coast and NO.3 nationwide in terms of deposit share. Strategically, it strongly emphasizes customer service quality and retention within the retail franchise and within its operation of the fourth largest domestic online bank. In addition, Wachovia has the third-largest full-service retail brokerage firm in the country with 4.4 million broker client accounts, 10,500 representatives and more than 700 offices in 49 states and in six Latin American countries. The extent ofWachovia's business diversification is further reflected by its position as one of the largest personal trust providers in the nation, the second largest bank seller of annuity products and a top-twenty mutual fund provider. The corporation's wealth operations are the fourth largest in its markets, based on assets under managements for clients with over $1 million. Corporate and investment banking activities place Wachovia in the top 3 for leveraged loan syndications and make it the leading U.S. CMBS loan contributor and master servicer.

During 2005, the corporation successfully integrated the operations of South Trust of Birmingham, Alabama, which it acquired in 2004, and grew its consolidated assets by 6% over the year. For the full-year 2005, Wachovia posted revenues of$26.1 billion and eamed net income of$6.6 billion, representing a retum on average assets of 1.31 %. In January 2006, the corporation reentered the credit card market as a direct issuer and as of March 1,2006, it completed its merger with WestCorp and its subsidiary WFS Financial Inc. of Califomia. The merger with Westcorp makes Wachovia the ninth-largest auto finance lender and provides the corporation with a small retail and commercial banking presence in Southern California. The proposed merger with the $128 billion Golden West Financial Corp., scheduled for the fourth quarter of 2006, would make Wachovia the fifth largest bank in the Westem US and expand its geographic footprint to cover 55% of the US population. On an intemational basis, the corporation's presence is currently limited; however it has stated its intent to expand in Europe and Asia within those markets where it has strong competence domestically.

Wachovia has a moderate inherent risk profile, satisfactory risk management and an RFI/C(D) rating for 2005 of 22212(2). In 2006, it has continued to make progress in addressing its main regulatory challenges in the areas ofIT infrastructure improvement, data center proximity risk, and BSA/AML compliance.

Corporate Strategy

As is the case with all large banking institutions, the strategic resources and competencies that Wachovia leverages today have formed through a series of historical mergers and acquisitions. Wachovia National Bank originally opened in Winston, North Carolina, back in 1879. In 1911, it merged with Wachovia Loan and Trust to form Wachovia Bank and Trust, which would eventually evolved into the Wachovia Corporation. First Union's roots similarly date back to the tum of the 20th century when Union National was established in Charlotte, North Carolina. In 1958, Union National merged with First National Bank and Trust Company of Asheville, North Carolina, forming First Union National Bank of North Carolina. Over the decades, First Union, through mergers with more than eighty banks and other companies, grew into a diversified financial service company. Today's Wachovia, as noted above, was formed by the 2001 merger of First Union Corp. and the legacy Wachovia. In connection with the merger, First Union changed its name to Wachovia Corp. In July 2003, Wachovia Corp. and Prudential Financial Inc. created a national retail financial advisory firm, becoming the third largest retail brokerage unit in the nation. In November 2004, Wachovia achieved further growth through the acquisition of SouthTrust Corporation, a $53 billion traditional banking organization based in Birmingham, Alabama.

Wachovia's overarching corporate strategy is to strengthen and grow core activities within its established, diversified business portfolio with an emphasis on customer service and retention. The organizational structure of the four business line portfolio is described in detail in the next section, which also outlines the strategic value propositions of each business. Strategies are implemented within the business lines through merger cost savings, revenue growth strategies and expense initiatives. The merger integration of South Trust was successfully completed over the course of 2005. In September 2005, Wachovia announced the purchase of the intemational correspondent banking business of Union Bank

CONFIDENTIAL FCIC-134448 Restricted - F.R.

of California and the further acquisition of AmNet Mortgage, the parent company of American Mortgage Network, a nationwide residential mortgage banker.

Historically associated with conservative lending practices, Wachovia has also recently undertaken new revenue growth activities which have a higher risk / return profile. Its March 2006 acquisition of Westcorp and subsidiary WFS Financial significantly extends the corporation's presence within the auto lending and sub-prime markets. From January 2006, Wachovia reentered the credit card business as a direct issuer following the merger ofMBNA with Bank of America. During the second quarter of 2006, Wachovia will acquire American Property Financing, Inc., the leading agency multifamily lender in New York City. In the fourth quarter of2006 Wachovia is scheduled to merge with Golden West Financial Corp. of California, the second largest savings bank in the US. Golden West, the only AA rated thrift in the nation, is a mono-line, niche player in option-ARM products.

In parallel with these growth strategies, Wachovia announced in January 2005, a strategic initiative to limit noninterest expense growth relative to revenues. The key themes ofthe initiative are end-to-end process improvement, staff efficiency and outsourcing / offshoring. Responsibility for achieving improvement targets is held at the business unit level and tracked within business unit performance. On a consolidated basis, the cash overhead efficiency ratio achieved 2005 was 57.96%, compared to 59.98% for 2004. Further details on the success of the expense initiative are given in the financial section below.

The future prospects for the continued financial strength of the corporation remain good. Asset quality metrics currently remain very strong and the corporation has weathered interest margin compression better than its peers. Revenue streams are diversified with 47% of annual net revenues being in the form of non interest income. While Wachovia's business line mix, with its substantial broker dealer operations, leads to a typically higher overhead ratio than traditional banking peers, expense constraint remains a key focus of management.

Organizational Structures, Business Line Strategies & Significant Activities

Wachovia's business model revolves around four operational lines of business: the General Bank, Capital Management, Wealth Management and the Corporate and Investment Bank (CIB); the structures of which are described in this section. These four businesses are overseen by the parent financial holding company and centralized treasury, risk management, human resources, legal and information technology functions.

Wachovia Corporation Revenue: $26 billion I I I I I I General Bank Capital Man. Wealth Man. CIB Parent Revenue: $13 billion Revenue: $5 billion Revenue: $1 billion Revenue: $6 billion Revenue: $1 billion

CONFIDENTIAL FCIC-134449 Restricted - F.R.

The General Bank Group (GBG) Structure

The General Bank serves 11 million retail and small business households in 15 States and Washington DC, through 3,159 financial centers, 5,100 automated teller machines, telephone banking and the Internet. The business line now services 3.2 million active online customers. GBG provides a broad range of products to individuals, corporations and government institutions and seeks to address the needs of three core markets: retail and small business, with annual revenues up to $3 million; business banking customers with revenues between $3 million and $15 million, and commercial customers with revenues up to $250 million. Customized retail deposit and lending products include checking, savings and money market accounts, time deposits, home equity, residential mortgage, student loans, credit cards and personal loans; and investment products include mutual funds, IRAs and annuities. Middle-market customers receive commercial deposit, lending and commercial real estate solutions, as well as access to asset management, global treasury management, and capital markets products and services through partnerships with Capital Management, Wealth Management, and CIB. The figure below shows GBG's second tier business lines, together with their revenue contributions and major management areas.

General Bank Group Revenue: $13 billion I

Retail & Small Business Commercial Credit Products Revenue: $9 billion I Revenue: $3 billion I I Revenue: $1 billion I Retail Small Business Middle Wachovia Wachovia - Banking I-- - Business Banking - r- Market Mortgage I-- Education Banking Commercial Corp. Finance

Northern Southern Real Estate ~y Dealer I Greenlink I Group ~~ Group Fin. Servo Finance

The largest bank franchise in the Southeast, GBG projects a dominant presence along the East coast and is ranked third nationwide on the basis of deposit share. It is the lead middle-market lender within its footprint and a top twelve nationwide mortgage lender. GBG's strategy is based on the diversity of its product offerings and markets. For the retail consumer, it seeks to provide products for all life stages, including savings, mortgages and retirement products. The retail sales management processes focus on customer needs assessment surrounding day-to-day money management, major purchase planning, financial future planning and unexpected event planning. The implementation of the business model stresses retail customer satisfaction and loyalty. GBG additionally seeks to address the needs of business of all sizes, with business checking, treasury services, global trade services, loans, leases and capital market products.

GBG has traditionally referred to the geographic regions in which small and medium enterprise commercial business is managed as well as the separately managed commercial real estate originated in the same footprint. Consumer loans are included in the GBG line for financial reporting, but this is also a separately managed business line. As of the SouthTmst merger, GBG Head, Ben Jenkins, reorganized the business line into a Northern Banking Group and a Southern Banking Group. The Northern region, headed by Reggie Davis and based in Charlotte, includes the Carolinas, MidAtlantic (MD, VA, & DC), Atlantic (CT, NJ, & NY) and PennlDel (PA and DE). The Southern Banking Group, headed by SouthTmst vice chairman Tom Coley and based in Atlanta, includes: Georgia, Florida, Texas and the Mid-South (AL, TN & MS). Wachovia currently has plans to open up to 100 additional branches. SouthTmst's Glenn Eubanks heads up Real Estate Financial Services. GBG is ranked No.2 in market share in Real Estate Financial Services.

Targeted acquisition strategy has added significantly to GBG's recent growth. The acquisition of SouthTmst boosted Wachovia's loan balances by 28% and deposits by 17% over the fourth quarter of2004. The integration of SouthTmst's businesses continued throughout 2005 and was completed successfully. GBG now houses the March 2006 WestCorp and WFS Financial acquisition, which added $528 million to average deposits over the first quarter 2006 within the Retail and Small Business segment, and $209 million average deposits plus $13 billion of loans within the Commercial segment. Westcorp's Ernest S. Rady is a new member of the Wachovia board and the chairman ofWachovia Dealer Finance.

CONFIDENTIAL FCIC-134450 Restricted - F.R.

GBG's average core deposits for the first quarter of 2006 were $216.4 billion, with average net loans of $178.4 billion. Loan balances are evenly split between retail & small business and commercial. The group's $12.8 billion annual revenue for 2005 was derived primarily from its retail and small business operation, which contributed $8.5 billion; in the form of $6.2 billion net interest income and $2.3 billion in fee and other income. The small business segment in isolation contributes $9 billion to loan balances and $26 billion dollars of deposits.

The proposed merger with Golden West Financial will incorporate the nation's second largest savings bank into GBG. As of March 2006, Golden West held $121 billion in loans and $62 billion in deposits. As the sixteenth largest mortgage originator in the US, Golden West originated $51.5 billion of loans in 2005. The thrift's 285 branches will give expand Wachovia's coverage into Arizona, Colorado, Kansas, Nevada and Illinois, and bolster its presence in California, Florida, New Jersey, New York and Texas.

Capital Management Structure

Capital Management Group (CMG) provides both proprietary and nonproprietary investment and retirement products, working with both retail and institutional clients. Wachovia Securities, whose retail brokerage operations fall within the Capital Management business line, operates through 2,700 offices in 49 states, Washington DC and Latin America. The other main business line within Capital Management is Evergreen Investments, a large and diversified asset management operation which, again, services both retail and institutional investors. The structure of Capital Management and the revenue contributions from its second tier business lines are shown below.

Capital Management Revenue: $5.2 billion

Retail Brokerage Services Asset Management Revenue: $4.1 billion Revenue: $0.9 billion

Services Evergreen Mutual Fund Annuity Investments Sales & Products Services Retail Service Brokerage Reinsurance Wealth Equity Equity Private Asset Management Trading Management Retail Fixed Income

Annuities & Reinsurance

CMG's retail brokerage operations constitute the third-largest full-service U.S. brokerage, with client assets as of March 2006 of $689 billion. It employs 10,500 registered representatives in 730 brokerage offices and 1,984 banking centers. The Retail Brokerage Services sub-segment, as shown above, includes the results ofthe Wachovia Securities brand retail brokerage activities, which are the combination ofWachovia's and Prudential Financial's retail brokerage operations. Retail brokerage uses multiple channels with some 76% of 2005 revenue being derived via the traditional retail brokerage Private Client Group; 15% via the bank channel, Investment Services, and 9% via independent financial advisors and correspondent firms.

The Asset Management sub-segment has $238 billion of assets under management of which 45% are in fixed income securities and 37% are equities. Asset Management is a top twenty mutual fund manager with $95 billion of mutual fund assets under management. The maj ority of its products and services are marketed under Evergreen Investments. In 1999, it acquired the Tattersall Group which provided fixed-income management products to institutional investors. In 2002, First Union acquired J.L. Kaplan offering small and mid-cap products. Asset Management also manages the assets related to client relationships maintained via the Wealth Management business line.

CONFIDENTIAL FCIC-134451 Restricted - F.R.

On June 1st 2006, Wachovia completed the acquisition of the defined contribution recordkeeping business of Ameriprise Financial Inc. of Minneapolis, adding significant scale to the Retirement Services business line, shown above, and expanding its national reach. The acquisition brings Wachovia's business to more than two million retirement plan participants. In tenns ofIRA assets, Retirement Services is No.6 in the nation. CMG's Reinsurance group reinsures life products from third party insurance carriers, annuities and loan related insurance products.

Historically, CMG's overall business model has drawn on a balance of revenue streams from both transaction-based and recurring fee business. Over 2005, CMG has made deliberate efforts to migrate revenue to a recurring fee basis. In the first quarter of 2006, CMG achieved record brokerage managed account assets of $119.8 billion.

Wealth Management Structure

In managing client financial assets, the Wealth Management business line deals with wealth creation and preservation and with generational transfers. The division's strategy is based around the use of dedicated relationship managers who coordinate with multiple financial advisors to meet client needs. The structure ofthe business line is shown below.

Wealth Management Revenue: $1.3 billion

Wealth Management (ex. Ins.) Revenue: $0.3 billion Commercial Life, Credit Insurance & Direct

Corporate & Affluent Life Insurance

Wealth Management is the fourth largest competitor in its markets based on assets under management for those clients having in excess of$1 million in investable assets. The division is a top three personal trust provider and a top ten conunercial insurance brokerage. I1lfough a separate practice called Calibre, it provides sophisticated investment and generational transfer solutions to ultra high net worth families. Wealth Credit provides customized loans and capital solutions to meet the tinancial needs of its high-net-worth clients. Credit tacilities and services are tailored to wealth clients and include commercial loans, revolving lines, installment loans, and mortgages

Annual Wealth Management revenues for 2005 were $1.3 billion, of which 55% is derived from fees and other income. As of the first quarter 2006, the business line had $134 billion of investment assets under administration and has responsibility over $68 billion of the assets under management within CMG. Wealth Management has 63,000 client rclationships and 973 wealth management advisors.

Wachovia Insurance Services provides commercial property insurance brokerage, risk management services, employee benefits, life insurance and personal insurance across 23 states and Washington D.C. Some 76% of its annual revenue of $320 million is derived from property and casualty insurance brokerage.

CONFIDENTIAL FCIC-134452 Restricted - F.R. Corporate and Investment Bank Structure

CIB's strategy is based on the linkage between a leading treasury services platform and the corporation's capital-raising capabilities. Operating under the Wachovia Securities brand, Wachovia Capital Markets and its affiliates service corporations with annual revenues over $250 million, financial institutions and institutional investors, and provide advisory, capital raising, structuring, research and execution services. The division also provides portfolio management, fixed income and equity sales and trading. CIB additionally incorporates the 3rd largest Treasury Services business in the U.S. as well as leading asset-based lending and global correspondent banking services. The figure below represents the main structural elements of CIB showing the revenue contributions of the second tier business lines.

Corporate & Investment Banking Revenue: $5.8 billion

I I Investment Banking 1 Principal Investing 1 Treasury Capital Finance I Revenue: $ 0.1 billion I Revenue: $ 0.4 billion I Revenue: $0.5 billion I Revenue: $0.9 billion Wachovia Corporate 1 1 Merger&~ 1 Billing I Product 1 Capital Acquisition Finance IMerchant ~ ~LeVeragedl Collection ~ 1Solutions Leasing Banking Capital Finance Private Fund 1 1 Client .1 Equity Investments Management 1 LeasingRail 1 Placement

I Equity Division Fixed Income Division Global Financial Revenue: $ 0.3 billion Revenue: $ 3.1 billion Revenue: $ 0.5 billion 1 1 1 1 Structured Credit Global Rate Structured Originations International Global Products Products Products Equity - - & Corporate Government Revenue: $1.6B Revenue: $1.0B Revenue: $O.5B Products Syndications Services Banking

Investment Grade Securities Trading Global Credit Domestic Derivative Trading & II High Yield Bonds Products Financial Products Research Institutions Loan Syndications I Derivatives I Trading I I I I I Taipei I Seoul Tokyo II London I Structured Product II ABS I Comm. RE Syndications CD Os I IShanghai II Hong Kong II Frankfurt I 1 London I Asia 1 Trading Trading

CIB engages with a full set of capital market products. The business line is the leading domestic CMBS loan contributor and master servicer. It is a top three player in leveraged loan syndications and U.S. collateralized debt obligations. Additionally, it is a top ten issuer of domestic high yield, high grade preferred stock and equity, and a top three U.S. asset based lending lead arranger.

As can be seen from the above figure, of CIB' s $5.8 billion annual revenue, some $3.1 billion is contributed by the fixed income division. Within this division, $1.6 billion of revenue comes from the Structured Products segment. Structured Products incorporates commercial real estate and ABS finance, ABS conduits, large loans, structured asset finance and leasing. The Credit Products segment includes investment grade, high yield bond sales and trading, credit derivatives, and money market securities. Global Rate products captures derivatives marketing and institutional sales, commodity derivatives and global foreign exchange. CIB's next largest revenue driver is Capital Finance which generates $0.9 billion dollars per year.

CONFIDENTIAL FCIC-134453 Restricted - F.R.

The Treasury Services division offers customers a suite of integrated payables and receivables solutions, including electronic check conversion, accounts receivable conversion, a full range of ACH services, image technology, a national wholesale and retaillockbox network and international treasury solutions. From February 2006, Treasury Services launched its international ACH capability, beginning with transactions to and from Canada and expanding to the UK, Germany, France and the Netherlands over 2006.

From January 2006, CIB expanded its real estate capital markets platform in Europe and commenced delivering commercial mortgage loan and REPO finance products in the UK and Germany. A securitization, structured finance and REPO warehouse business has been developed in London, with origination throughout Europe being driven from the Frankfurt and London offices. In April 2006 Wachovia's Real Estate Capital Markets Group announced an agreement to acquire American Property Financing, the lead agency multifamily lender in New York City and a leading player in Fannie Mae and Freddie Mac programs.

Revenue and Risk Drivers

Wachovia's total revenue for the year 2005 was $26.1 billion. Net interest income was $13.9 billion and noninterest income was $12.2 billion. Net income for the year was $6.6 billion. The table and figure below show the main revenue contributions from the business lines described in the previous section.

R evenue an dEarnmgs C on t·bn U f IOns an dAverage C apl·t a I All ocaf IOns Full-Year 2005 Revenue % Net % Average Economic Capital % RAROC 2005 Income over Period ($B) % Business Line ($B) (SB) Credit Market Other Total GBG Retail & Small 8.52 32% 2.39 36% 2.48 15% 96.58% Business GBG Wholesale 3.58 14% 1.44 22% 3.67 22% 34.70% General Bank Other 0.66 3% 0.07 1% 0.87 5% - General Bank 12.76 49% 3.90 59% 5.18 0.11 1.73 7.02 42% 53.26% CMG. Retail Brokerage 4.19 16% 0.45 7% 0.99 6% 45.10% CMG Asset Management 0.69 3% 0.10 1% 0.15 1% 63.08% CMG Other 0.30 1% 0.03 1% 022 1% - Capital Management 5.18 20% 0.58 9% 0.27 0.05 1.04 1.36 8% 42.45% Wealth Management 1.30 5% 0.26 4% 0.26 - 0.45 0.51 3% 47.83% CIB Principal Investing 0.40 2% 0.23 4% 0.68 4% 34.14% ClB Fixed Income 3.08 12% 1.18 18% 3.17 19% 34.27% Division CIB Equity Division 0.33 1% (0.05) -1% 0.21 1% -24.60% CIB Capital Finance 0.85 3% 0.35 5% 1.04 6% 30.925 CTB Other 1.10 4% 0.01 - 0.34 2% - CIB 5.76 22% 1.72 26% 3.23 1.16 1.05 5.44 32% 29.54% Parent 1.12 4% 0.14 2% 0.94 1.28 0.37 2.59 15% 13.84% Consolidated 26.12 100% 6.60 100% 9.89 2.59 4.45 16.93 100% 38.57% Merger and Restructuring (0.17) Discontinued Operations 0.21 GAAP Net Income 2005 6.64 First Quarter 2006 ($B) % (SB) 0/0 Credit Market Other Total 0/0 General Bank 3.49 49% 1.11 63% 5.43 0.11 1.89 7.43 41% 58.28% Capital Management 1.41 20% 0.18 10% 0.26 .0.5 1.24 1.55 9% 47.20% Wealth Management 0.34 5% 0.06 3% 0.27 - 0.24 0.52 3% 42.87% CIB 1.71 24% 0.52 29% 3.56 1.13 1.25 5.94 33% 33.66% Parent 0.10 1% ffill -5% 0.97 1.06 0.65 2.68 14% -6.68% Consolidated 7.06 100% 1.77 100% 10.49 2.36 5.27 18.12 100% 39.22% Merger and Restructuring (0.04) GAAP Net Income 1Q06 1.73

CONFIDENTIAL FCIC-134454 Restricted - F.R.

Contibution to 2005 Revenue: Total $26.1 Billion

OtherCIB Parent 10% GBG Retail & Sinall CIB Fixed Income Busil11ess

Management Brokerage 4% 16%

Wachovia's corporate strategy is underpinned by the diversity of its sources of revenue from the various business lines, relative to traditional banking peers. The General Banking Group derives 49% of consolidated revenues. Within GBG, Retail and Small Business activity contributes 32% of consolidated revenues. The next largest revenue stream (16%) is the retail brokerage activity within Capital Management. The Corporate and Investment Bank adds 22% of revenues, primarily from its Fixed Income Division (12%) as described previously. A further 4% is derived through the bank's Capital Finance operations. The Wealth Management division contributes 5% of revenues.

The total net revenue described above ($26.1 billion) is net of the interest expense incurred for each business line. The total gross revenue generation (i.e. interest income plus noninterest income) by all product and service activities in 2005 was $36.1 billion. The sources ofthe corporation's gross revenue are shown in the figure below.

CONFIDENTIAL FCIC-134455 Restricted - F.R.

Wachovia Sources of Gross Revenues 2005: Total $36.1 B Fiduc.& Asset Man. 8% Advise,UlINrt&lnv.Bkg. 3% Other Inc. Commissions 4% 7% Consumer R.E. 12%

Loans

Derivatives 40% 3%

PI 1% 3%

Securities Gain 0% LFS & Other 4% Securities Interest J Fed 16% Tradin~ Gain 1% 5%

Some 40% of gross revenues flow from loan activities of which commercial, financial and agricultural loan interest contributes 13%. Interest on consumer real estate constitutes 12% of all revenues. Interest on securities represents 16% of annual receipts. Against the backdrop of rising interest rates, Wachovia's net interest margin contracted to 3.24% for 2005 from 3.41 % in 2004. (The net interest margin achieved over the first quarter of2006 was 3.21 %). While the 2005 revenues demonstrate the corporation's traditional emphasis on commercial lending relative to its peers, the 2006 acquisition of West Corp has raised the contribution of consumer loans and has also led to a higher anticipated loan provision charge for 2006. Currently asset quality remains strong with charge-offs to average loans running at 0.09% and nonperforming assets to loans being 0.28%.

In January 2005, Wachovia announced an initiative to drive down the rate of its expense growth. The intent is to slow expense growth by an amount of $600 million to $1. 0 billion by 2007. The metric used to monitor expense restraint is the cash overhead efficiency ratio which excludes merger-related and restructuring expenses, other intangible amortization, discontinued operations, and changes in accounting principles. Targets have been established for this metric for each business line as follows.

Cash Overhead Efficiency Ratio 2006 Ql 2005 Q4 Target 2007 General Bank 48.06% 50.53% 45 - 47% Capital Management 79.84% 82.61% 75 -77% Wealth Management 73.21% 73.32% 60 - 62% CIB 51.90% 54.76% 49 - 51% Corporation 57.81% 61.41 % 52-55%

CONFIDENTIAL FCIC-134456 Restricted - F.R.

The graph below demonstrates the progress achieved to date towards the stated goal.

GA/JP & Cash Overhead Efficiency Ratios 2004 - 2006 with 2007 Target 8,000

2: 7,000 '2F- ". In VI Ir? :a !?l !!!. ... IV ::l 6,000 !B.'" > Ql '"IV ~ < 5,000 w '2F- 06 Q) IV ::l " IV d "> 0 IV 0:: 4,000 a::~

2004 Q1 2004 Q2 2004 Q3 2004 Q4 2005 Q1 2005 Q2 2005 Q3 2005 Q4 2006 Q1 2006 Q2 2006Q3 2006 Q4 End 2007

~ Total Revenue ~ Total Nonlnterest Expense Target Range 52-55% -;;-GP-flP Overhead Efficiency Ratio -><-Cash Overhead Eff. Ratio

Wachovia's capital position remains satisfactory. As at 03/31/06, the tier 1 risk-based capital ratio, tier 1 leverage ratio and total risk-based capital ratios were 7.87%, 6.86% and 11.45% respectively. Total shareholder equity was $49.8 billion and Tangible Common Equity was $26.4 billion. This compares to the first quarter 2006 average capital required of $18.1 billion, as calculated by Wachovia's economic capital model (see page 9 above). In January 2006, the corporation conducted a successful $2.5 billion issue oftier 1 Wachovia Investment Trust Securities, which are mandatory convertible to non-cumulative perpetual preterred stock. The issue facilitated the repurchase of38.3 million shares at a cost of $2.1 billion. Following the issue and repurchases, Tier I regulatory capital as of 03/31/06 was $34.0 billion.

Corporate Governance

Members of th e Board of Directors:

G. Kennedy Thompson Chairman, President & CEO ofWachovia Corporation John D. BakerIl President & CEO, Florida Rock Industries, Inc., Jacksonville, Florida. Robert J. Brown Chairman & CEO, B&C Associates Inc. High Point, North Carolina. Peter C. Browning Chairman, Nucor Corporation, Charlotte, North Carolina. John T. Casteen III President, University of Virginia, Charlottesville, Virginia. William H. Goodwin Jf. Chairman, CCA Industries Inc. and Riverstone Group LLC, Richmond Virginia. Robert A. Ingram Vice Chairman Pharmaceuticals, GlaxoSmithKline plc Research Triangle Park, NC. Donald M. James Chairman & CEO, Vulcan Materials Company, Birmingham, Alabama. Mackey J. McDonald Chairman, President & CEO, VF Corporation, Greensboro, North Carolina. Joseph Neubauer Chairman & CEO, ARAMARK Corporation, Philadelphia, Pennsylvania. Ernest S. Rady Chairman Wachovia Dealer Finance, Wachovia Corporation. Van L. Richey President & CEO, American Cast Iron Pipe Company, Birmingham, Alabama. Ruth G. Shaw President & CEO, Duke Power Company, Duke Energy Corporation, Charlotte, NC. Lanty L. Smith Chairman, Soles Brower Smith & Co., Greensboro, North Carolina. John C. Whitaker Jf. Chairman & CEO, Inmar, Inc. Winston-Salem, North Carolina. Dona Davis Young Chairman, President & CEO, the Phoenix Companies Inc. Hartford, Connecticut.

CONFIDENTIAL FCIC-134457 Restricted - F.R.

Executive Management

Ken Thompson, Chairman, President & CEO Tom Wurtz, CFO & Head of Finance Ben Jenkins, Vie Chairman, Head ofthe General Bank David Carroll, Head of Capital Management Steve Cummings, Head of CIB Stan Kelly, Head of Wealth Management Don Truslow, Chief Risk Officer, Head of Risk Mark Treanor, General Counsel and Head of Legal Jean Davis, Head of Operations, Technology and eCommerce Shannon McFayden, Head of Human Resources and Corporate Relations

Committees of th e Board of Directors

On an annual basis the board approves a risk policy which delegates risk oversight to the Risk Committee ofthe Board. This committee, in tum, delegates to the Senior Risk Committee of management, which is the governing body for five managing committees: ALCO, Market Risk, Credit Risk, Operational Risk and Conflict Review.

RISK COMMITTEE AUDIT COMMITTEE; OF THE BOARD OFTHEBoARD

e8jl!bli~,h~ci jar 1I) ofthe 12 id!!nllfilld Fu flcllonal Risk Areas of Operational Rlstl

The Board of Directors, with the assistance of its Risk Committee and Audit Committee is responsible for the oversight of the corporation's risk governance processes.

The Risk Committee of the Board consists of a minimum ofthree non-management directors and members ofthe committee are appointed by the board. The committee meets in conjunction with regularly scheduled board meetings on a bi-monthly basis. The committee receives information regarding the corporation's policies, procedures and practices relating to all categories of risk. The Charter of the Risk Committee of the Board stipulates the information to be received from the Senior Risk Committee, the ALCO, and the Market, Credit and Operational Risk Committees.

The Audit Committee of the Board is responsible for ensuring that all areas of the corporation have satisfactory internal controls that are operating effectively.

Under the corporation's risk governance policy, the Operating Committee of Executive Management is responsible for

CONFIDENTIAL FCIC-134458 Restricted - F.R.

managing risks relating to business strategy, reputation risk and the general business activities of the corporation. The committee meets on a monthly basis and receives MIS covering the financial results and metrics for the prior month. Monthly income statements, performance metrics and economic capital allocations are provided for every business line.

The Senior Risk Committee is appointed by the Risk Committee of the Board. It is responsible for monitoring the direction of all types of risk relative to the corporation's business strategy. It also reviews emerging risks and monitors the steps taken to mitigate such risks. The committee meets monthly and consists of members of the Operating Committee.

The Asset and Liability Committee is tasked with the oversight of liquidity risk and interest rate sensitivity risk. The Chief Financial Officer reports directly to the CEO and is accountable for the management of these risks.

The Chief Risk Officer reports to the CEO and is responsible for the independent evaluation of credit, market and operational risk and for risk governance processes.

The Credit Risk, Market Risk and Operational Risk Committees are appointed by the Senior Risk Committee and are responsible for the policies and limits associated with there respective risks.

The Conflict Review Committee provides oversight of conflicts of interest that may arise across the institution. The committee provides a mechanism to address conflicts and a forum for resolution of cross line business conflicts.

Wachovia's Internal Audit Function reviews the corporation by dividing it into 350 audit entities which are individually risk-assessed and prioritized. Fifty high risk entities are audited every year, 214 medium risk entities are audited every two years, and 86 lower risk entities are reviewed once in three years. The majority ofthe 50 high risk entities reside in CIB (17) and IT (14). As of December 2005, Wachovia had 280 internal audit staff, having grown the function aggressively since 2003. Turnover of staff is below industry average with 48 staffleaving the audit function in 2005, of whom 26 left the company. Budgeted audit plan hours for 2006 total 474,000.

The corporation's external auditors are KPMG, who meet with management on a regular basis to discuss current accounting and internal control issues.

Legal Entity Structure

As of March 2006, the parent Wachovia Corp. held assets of $85.3 billion of which 84% were investments in subsidiaries and associated companies. As noted above, equity capital was $49.8 billion and the debt to equity leverage ratio was 54.92%. The double leverage ratio of equity investments in subsidiaries to equity stood at 122.82%. The schematic at the end of this section shows a representation of the main subsidiaries of the corporation.

As of March, 2006, Wachovia's consolidated assets stood at $541.8 billion. The assets of the national banking franchise, Wachovia Bank NA. (WBNA) were $496.6 billion, equivalent to some 92% of consolidated assets. The table below shows the dominance ofthe bank on the corporation's interest-related earnings.

Wachovia 2005 WBNA2005 WBNA2004 Net Interest Income ($B) 13.90 13.46 11.28 Noninterest Income ($B) 12.22 6.82 5.96 Noninterest Expense ($B) 15.85 11.56 10.45 Provision ($B) 0.25 0.18 0.22 Net Income ($B) 6.64 6.04 4.71 Tier 1 Leverage Ratio (%) 6.12% 6.26% 6.14% Equity Capital ($B) 47.56 47.38 32.92 Gross Loans ($B) 271.61 262.18 199.12 ALLL ($B) 2.72 2.63 2.26

Primary operating subsidiaries under WBNA include:

CONFIDENTIAL FCIC-134459 Restricted - F.R.

• Evergreen Investment Company, Inc., the Boston, MA, based investment management service. Evergreen is the asset management vehicle for the Wachovia's Capital Management business line described above.

• Wachovia International Banking Corp., an Edge corporation with assets of $4.17 billion as of 12/31/05, acts as the parent company for overseas activities conducted through the following main subsidiaries:-

y Wachovia Securities International Ltd (WSIL), London, houses Wachovia's main European capital markets activities. WSIL serves two main functions: to market CIB investment products in the European arena and to conduct specific trading and distribution activities. Strategically, Wachovia is looking to extend its product base and trading operations in Europe. During 2005, WSIL generated a net loss of$12.5 million. As of 12/31/05, the company held assets of$3.39 billion and equity capital of$268.5 million. WSIL is authorized and regulated by the Financial Services Authority in the UK and utilizes the Wachovia Securities trade name.

y Wachovia Capital Finance Corporation (Canada), formally Congress Financial of Canada, conducts asset based lending in Canada. Following the retirement of the Congress brand in the US in March 2005, Congress Financial of Canada was re-branded in January 2006 to leverage CIB's capital finance reputation. As of 12/31/05, Congress Financial Corp. Canada had assets of$650.8 million and earned net income of$3.85 million for the year on revenues of $15.8 million.

• Cardinal International Leasing, with assets of$6.49 billion, holds the legacy First Union international banking operations. Cardinal earned $48.7 million in 2005.

• Wachovia Financial Services Inc. absorbed the business ofthe former Agreement corp. First Union Overseas Investment Corporation (FUOIC) in January 2006. As of 12/31/05, FUOIC had assets of $340.5 million. The former subsidiary ofFUOIC, Union Hamilton Assurance Ltd, Bermuda, merged with Wachovia Re Inc. of Columbia, SC, in February 2006. As of 12/31/05, Union Hamilton Assurance had assets of $311.8 million.

• WBNA also owns the smaller Agreement corporations Monument Street International Funding I & II, of Roseville, CA, each with assets of$10.6 million and which own First International Advisors in London.

Apart from WBNA, Wachovia additionally owns the Wachovia Bank of Delaware, NA., a $2 billion commercial bank based in Wilmington, DE.

In addition to these two banks and their subsidiaries, Wachovia Corp. owns significant nonbank subsidiaries as described below:

• Everen Capital Corporation (assets as of 12/31/05: $4.90 billion.) is the holding company for substantial nonbank activity conducted under the broadly used Wachovia Securities brand, primarily through Wachovia Securities LLC and Wachovia Capital Markets LLC. Wachovia Securities is the trade name for both the corporate and investment banking businesses ofWachovia (including Wachovia Capital Markets LLC and also the Edge Corp. subsidiary WSIL, described above) and also the retail brokerage businesses ofWachovia Securities LLC, Wachovia Securities Financial Networks LLC and First Clearing LLC.

• Wachovia Securities LLC (WSLLC) is registered as a broker-dealer with the Securities Exchange Commission and is a wholly owned subsidiary ofWachovia Securities Financial Holdings LLC (WSFH), which, in tum, is a majority owned consolidated subsidiary ofWachovia Corp. WSFH (with assets: $2.67 billion) serves as a holding company for the retail brokerage and clearing businesses contributed by Wachovia and Prudential Financial, Inc. and is based in Richmond, VA. Wachovia and Prudential own 62% and 38% respectively of WSFH. In November 2004, Wachovia acquired South Trust Securities, Inc. In December 2004, this entity was converted to a Delaware limited liability company and renamed South Trust Securities LLC. From April 2005, this company became part ofWachovia Securities LLC. The company additionally merged the business of Wexford Clearing Services LLC. As of 12/31/05, the consolidated assets ofWSLLC and its subsidiaries were $6.57 billion. Of this, some 49%, or $3.22 billion, was held as securities purchased under agreement to resell. Additionally, the fair value of securities owned by WSLLC was $0.96 billion, or 15% of its consolidated assets.

CONFIDENTIAL FCIC-134460 Restricted - F.R.

• WSFH's principal operating subsidiaries, other than Wachovia Securities LLC, are First Clearing LLC and the brokerage Wachovia Securities Financial Network, LLC. WSLLC clears its brokerage transactions through First Clearing LLC.

• Wachovia Capital Markets LLC (WCM) is the corporate and investment banking arm ofthe Wachovia Securities brand and is based in Charlotte, North Carolina. Wachovia Capital Markets (assets $23.2 billion) is a registered broker dealer and possesses expertise particularly in the retail, defense, aerospace, utilities, financial services, health care, media and technology industries. As a vehicle for CIB activity, WCM provides advisory services, private capital, corporate lending and leasing, underwriting and trading services.

• Other CIB vehicles for investment banking activity include: Wachovia Capital Investments Inc., the home to legacy First Union investment banking operations (assets $1.46 billion); Wachovia Investors Inc. which is used to fund Wachovia's originated and acquired investments in funds, private equity and mezzanine investments (assets $1.91 billion), and Wachovia Development Corp, with assets of$1.l3 billion.

• Insurance operations are conducted by the agency Wachovia Insurance Services, which now houses the activities acquired from Palmer and Cay.

• Union Hamilton Reinsurance houses \Vachovia's reinsurance operations in Bermuda with assets of$2.95 billion. Wachovia additionally owns Bluepoint Re, with assets of$356.1 million; also in Bermuda.

CONFIDENTIAL FCI C-134461 Restricted - F. R. The graphic below shows the main subsidiaries within the Wachovia group. Prudential Financial Inc Wachovia Corp. $5418

Wachovia Bank N.A. $4978

Wachovia loternational Banking Corp

Wachovia Capital Investments

CardinallnternatiotJCl.Il..eCising Wachovia Investors

Wachovra Finaocial Bluepoint Wachovia Services Reinsurance Development Corp Wachovia Insurance Wachovia Re Union Services Hamilton Reinsurance Palmer& Cay

Wachovia Bank of Delaware N.A.

IBank 11&1 International III Retail Investment I I ICIB Non Bank Entities I IInsurancel

CONFIDENTIAL FCIC-134462 Restricted - F.R. Regulatory Scheme The FRE has supervisory authority for the Wachovia Corporation financial holding company, the Edge and Agreement corporations and their international subsidiaries. Nonbank subsidiaries ofthe holding company which engage in securities, commodities or insurance activities are supervised and regulated by the appropriate functional regulators. In its role as the umbrella supervisor, the FRE monitors functionally regulated entities on an ongoing basis. The FRE also conducts supervisory activities in respect to other nonbank subsidiaries ofthe holding company. The table below lists the supervisory coverage of the corporation and its significant subsidiaries.

Legal Entity Institution type Supervisor FRB Filing Wachovia Corporation Financial Holding Company FRE FRY91Y9LP Wachovia Bank NA National Bank OCC Call Wachovia International Banking Corp Investment Edge Corporation FRE FR2886b Wachovia Securities International Ltd Foreign Subsidiary FRE (FSA in UK) FR2314

Capital Finance Canada Foreign Subsidiary FRE FR2314 Cardinal Leasing International Agreement Corporation FRE FR2886b Monument Street Funding Agreement Corporation FRE FR2886b Evergreen Investment Management Corp. Investment Advisor SEC - Wachovia Bank of Delaware NA National Bank OCC Call Everen Capital Corporation Non-Bank Subsidiary FRE FRY11 Waehovia Capital Markets Securities Broker Dealer SEC - Wachovia Capital Investments Investment Advisor SEC FRYll Wachovia Investors Non-Bank Subsidiary FRE FRYll Wachovia Development Corporation Non-Bank Subsidiary FRE FRYll Wachovia Securities Holdings Non-Bank Subsidiary FRE FRY11 Waehovia Securities Financial Holdings Non-Bank Subsidiary FRE FRYll Wachovia Securities LLC Securities Broker Dealer SEC - First Clearing LLC Securities Broker Dealer SEC - Wachovia Securities Financial Network Securities Broker Dealer SEC - Bluepoint Reinsurance Foreign Subsidiary FRE FR2314 Union Hamilton Reinsurance Foreign Subsidiary FRE FR2314 Wachovia Insurance Services Insurance Agency States -

As described in the previous section, the substantial majority ofWachovia's assets reside in the national bank franchise, particularly those managed under the auspices of the General Banking Group. The Office ofthe Comptroller of the Currency (OCC) retains a resident team onsite at Wachovia to exercise authority under the national banking charter. The OCC staffis comprised of36 examiners under 5 subject teams (Credit, Operations, Finance & Markets, Asset Management, and IT). Additionally a resident Consumer Compliance unit works out ofthe Large Bank District Office located in Charlotte. In addition to the FRE and OCC, the FDIC has a resident program, developed in 2002 for the largest 8 institutions. Currently, only one individual is assigned to Wachovia, and activities are limited to preparing analyses on financial performance, attending meetings with the FRE and OCC, and participating in limited examination activity being conducted by the FRE and OCe.

The FRE monitors and conducts mandated annual reviews on the Edge and Agreement Corps. and their subsidiaries, which reside under the lead national bank. The most signiilcant risks associated with Edge corp. activity lie with CIB's operations through WSIL, which is additionally regulated by the UK's Financial Services Authority (FSA). Other foreign regulatory bodies conduct visitations at other Wachovia business offices in Asia, Latin America, and Continental Europe. To date, the resident Federal Reserve team has not interacted with other Foreign Regulators except with the FSA in the UK.

The FRE additionally conducts an annual nonbank risk assessment which incorporates both nonbank subsidiaries for whom the FRE is the sole supervisor and those entities functionally regulated by other agencies. The ongoing monitoring efforts and targeted examinations associated with the CIB business line include the operations of 18

CONFIDENTIAL FCIC-134463 Restricted - F.R. investment banking entities and the wholesale broker dealer. Similarly, FRB conducts ongoing monitoring of the retail broker dealer activities ofWachovia Securities LLC and its affiliates within the Capital Management and Wealth Management business lines.

Securities and Exchange Commission (SEC) is the functional regulator for Wachovia Securities broker dealer operations and is responsible for supervising Wachovia's compliance with federal securities laws and regulations. In addition, the National Association of Securities Dealers (NASD) retains an interest in Wachovia's actions related to compliance with broker dealer guidelines and regulations.

Wachovia's insurance activities also introduce the regulatory parameters of several state insurance commissions, which retain primary responsibility for interstate insurance sales and underwriting. Most ofWachovia's insurance businesses are agency-based, providing very little underwriting activity. As a result, and given the state commissions' limited resources, regulatory influence has been fairly limited. FRB resident examiners work closely with state agencies to ensure appropriate monitoring of risk management and sales programs.

CONFIDENTIAL FCIC-134464 Restricted - F.R. II. Risk Assessment Summary

Consolidated Executive Summary

Overall Summary Assessment of Inherent Risk

The inherent risk profile is considered moderate, which is unchanged from the previous assessment. Overall, Wachovia continues to benefits from a diversified business mix, the large domestic geographic footprint, and management's measured risk appetite. As noted in the 110, the company's has four main business lines that each offer a wide range of products that contribute to a diversified revenue base. The corporation is the fourth-largest financial holding company in the United States, with consolidated total assets of $542 billion. The proposed Golden West Financial acquisition will increase the mortgage portfolio by approximately $125 billion, add non-traditional mortgage products (mainly option adjustable rate mortgages) to the balance sheet, and expand the company into several new markets. However, this acquisition is not expected to significantly change the inherent risk profile of the company as thc thrift is in strong condition and has not suffcrcd a loan loss in cight ycars. In addition, intcrnational opcrations arc growing, but remain much smaller than other larger bank holding companies. Also, the company is traditionally disciplined with investment decisions and utilizes a RAROC based model across all business segments to ensure that risk return hurdles are met. With acquisitions, the target transaction must be cash accretive in two years and have an internal rate of return of 15%. Management has publicly stated it will take a conservative approach towards mergers and in 2005 Wachovia did not purchase MBNA due to price and return concerns.

Inherent Risk by Risk Type

Consolidated Inherent Risk Ratings

Credit

Wachovia's inherent credit risk profile is moderate, albeit at the low end of the range. Overall credit risk benefits from higher quality obligors, strong collateralization levels, product and geographic diversity, and mitigation actions by management. The previous assessment was limited and Wachovia's traditional asset quality measures continued to be strong and compare favorably with historic norms and peer institutions. While traditional credit quality metrics reflect a limited or low inherent credit risk assessment, the moderate assessment is based on the recent shift in Wachovia's risk appetite not yet reflected in lagging asset quality ratios. Wachovia has made the strategic decisions to cxpand its lcnding univcrsc to riskicr customcrs in scvcral cxisting consumcr lincs ofbusincss. Also, thc cntry into thc sub-prime auto financing market with the purchase of WestCorp, an elevated level of conlluercial real estate exposure, and an upward trend in notional/capital house limit exceptions add to inherent credit risk. In addition, liquidity in the credit markets contributes to the moderate assessment. A number of reports, including Fitch's recent report entitled "Loan Volumes Surge, Covenants Shrink in 2005", give empirical evidence supporting market consensus that lending standards have continued to loosen. Wachovia management has indicated that debt/EBITDA ratios for bank debt in the leveraged loan market are the highest since 1988. Process changes in GBG and CIB could impact inherent credit risk, at least in the short term. They include GBG's implementation of an "end to end" rollout that involves centralization ofloan approval/servicing processes and CTB's new servicing procedures.

CONFIDENTIAL FCIC-134465 Restricted - F.R. Market (Trading Book)

Trading book market risk is moderate. Wachovia's trading activity is generally a customer flow business, meeting customer needs and then laying off much of the risk to the street. Proprietary trading is limited to modest directional plays on customer flows and small proprietary desks in convertibles, credit product, short-dated options, and liquid equities. While flow business is generally lower risk, the company generates a moderate risk profile once their more complex activities are considered. Wachovia has built CIB on the strength of their structured and complex,less-liquid products. In fact, structured products accounted for 38.5% of total 2005 Global Markets income, a total which reached 51.0% if you include credit products in the numerator. CIB has ambitious growth plans and management continues to look for ways to expand these business areas looking to Europe and Asia. In terms of standard risk metrics, inherent risk has been stable at a limited level with Value-at-Risk (VaR) remaining in the $18-22 million range in 2005, very similar to the prior year and well within the $30 million limit. Exposures to desk levcllimits (Greeks, DVOl, Notional) have also remained fairly limited & stable. Given the risk metries and trading portfolio P&L composition, the institution merits a moderate inherent risk rating in this area.

Market (Banking Book)

Inherent banking book market risk is limited. Although Wachovia is a large complex institution, management has a conservative philosophy and risk posed by the complexity of business activity is managed away through strategic balance sheet decisions and the use off-balance sheet derivatives. Inherent risk is limited by design and management aims to produce stable net interest income without incurring excessive interest rate risk. They do take an occasional view on rates, but are quick to hedge that risk when the outlook is unclear. The past year's actions are evident of that philosophy. Wachovia's short-term measure, Earnings-at-Risk (EaR), migrated from slightly asset sensitive (1.0%) in June 2005 to moderately liability sensitive (-2.2%) in March 2006 on the belief that implied forward rates were too high. In March, however, management moved back to a neutral stance due to uncertainty on future rate forecasts. The long-term measure, Economic Value of Equity (EVE), suggests a more moderate risk profile, due largely to the sizable mortgage-related portfolio. Management has been e±Iective at hedging mortgage risk in the short-term, but the EVE measure highlights this exposure. The March 2006 results showed a 10.5% liability sensitivity, static from the prior quarter. While management finds EVE a useful measure, EaR remains the primary IRR metric.

Liquidity

Inherent liquidity risk is limited. Wachovia benefits from a positive reputation in both the market and retail deposit environment. Funding is primarily driven by a strong deposit base that has proven stable even as Wachovia's offering rates have lagged market rate increases. Management attributes this loyalty to excellent customer service ratings, consistently tops in the nation. While management does strategically target certain markets with promotional rates, corporate philosophy is to remain competitive through pricing in the middle of most markets. Deposit market share metrics indicate this has been successful with the bank leading competitors throughout its native regions, the mid Atlantic and Southeast. As deposit growth has stabilized over recent periods, loan growth has increased. Management prefers to fund this growth through retail deposits, but to supplement shortfalls, management regularly accesses wholesale funding. Over the past year, the level of wholesale funding has increased, but the ratio of wholesale borrowings to total assets has remained constant. Positive debt ratings and strong investor demand have afforded Wachovia favorable pricing. With loan growth projected to outpace deposit growth over the next year, management is forecasting debt issues to return to prior levels, equaling roughly $10 billion for 2006. A change from prior years, though, is a focus to diversify market funding. Management will complete its first European offering in June 2006 and anticipates another European issuance later in the year.

CONFIDENTIAL FCIC-134466 Restricted - F.R.

Operational Risk

The level of inherent operational risk for the company has declined somewhat and is rated as considerable. Risk levels have decreased, but the considerable assessment ret1ects inherent issues with the technology infrastructure and the geographic concentration ofIT resources in Winston Salem, North Carolina. Over the past year the company has demonstrated satisfactory information technology (IT) production stability with only occasional issues noted. Network outages have been negligible and critical systems are operating within acceptable parameters. Additionally, there is adequate capacity to ensure daily production of all major processes and system response times have been strong. Consequently, customer satisfaction is at an all time high with regard to availability of technology solutions. Disaster recovery testing conducted in the past year was successfully completed as well. To ensure ongoing improvement, various projects arc underway to advance the efficiency of the underlying infrastructure. Likewise, the company has gone to great lengths to train and retain its staff of IT subj ect matter experts.

Wachovia does, however, continue to face some challenges and legacy operational risk issues remain a key supervisory concern particularly with proximity risk related to the company's two data centers in Winston-Salem, North Carolina. Also, the company has started an aggressive offshoring/outsourcing program and with the offshoring of applications and business processes comes delegation of critical controls to third-parties domiciled in foreign sovereignties. From a systems perspective, its technology environment consists of a disparate portfolio oftechnology infrastructures, applications, and reporting systems. This situation is a product of years of mergers, acquisitions and wide-ranging business line technology deployments. Remediation efforts aimed at addressing these long-standing issues are continuing with expected completion of the projects by year-end 2006. While the corporate wide technology issues arc being remediated, business line specific infrastructure improvements arc still needed and the detailed assessment documents the infrastructure issues in CIB. Finally, although Wachovia is not a key player in the critical payments markets, the increasing volume and nature of transactions adds complexity as the company's presence in the national payments system becomes increasingly prominent.

Legal and Compliance

Inherent legal and compliance risk is considerable. Wachovia's size and geographic footprint are drivers of this assessment. In addition, they offer a diverse array of products which includes traditional consumer banking as well as online banking (4th largest domestic), private banking, retail brokerage (3 rd largest), corporate and investment banking, consumer lending, and correspondent banking. Through these businesses and locations, they deal with numerous regulators including the OCC, NYSE, NASD, SEC, various state securities and insurance regulators, as well as foreign regulators such as the FSA and HKMA. As with the industry as a whole, BSAIAML and privacylinformation security elevate the compliance risk profile. Also, recent acquisitions have increased correspondent banking, subprime indirect auto lending (new and used), and mortgage lending. Wachovia's lack of a substantial global presence is a contributor to its considerable legal and compliance risk profile. Until recently, the company did not offer credit cards and this product is traditionally the largest contributor to complaint activities. Litigation levels have remained moderate and to date they have not had any major control breakdowns which typically result in settlements.

CONFIDENTIAL FCIC-134467 Restricted - F.R. Overall Summary Assessment of Risk Management

Overall risk management practices for Wachovia Corporation are considered satisfactory. The assessment is based on management's actions to address most of the key risks facing the institution and the effectiveness of controls and oversight across the company. In 2005, the company successfully merged SouthTrust's operations, with no signifIcant impact to operations, and converted its general ledger. The company continued to effectively mitigate credit risk utilizing credit derivatives, loan sales, and securitization markets. The implementation of the Searchspace application was completed in July 2005 and corporate-wide suspicious activity monitoring and reporting is adequate. While management can be proactive in addressing emerging or significant risks facing the corporation, the company has been slow to correct long standing infrastructure issues. These include the development of an out-of-territory disaster recovery plan and improving CIB trading infrastructure. This Reserve Bank will continue to highlight these issues in rcgulatory correspondence such as the February 17,2006, letter to CEO Thompson on mitigating proximity risk.

Risk Management and Controls

Consolidated Risk Management and Controls Summary

Board and Senior Management Oversight

Board of Directors and senior management oversight is satisfactory. The board through regular communications is updated and provides input to senior management on key risks facing the corporation through its committee structure. This communication has enabled the board to provide senior management guidance on key corporate initiatives including infrastructure improvement projects, outsourcing/offshoring, and efficiency initiatives. CEO Thompson and his senior management team continue to provide capable, experienced leadership and communicated the risk appetite effectively to the organization as a whole. Where risk management weaknesses exist, management is generally taking the appropriate steps to address them. Management can be reactive specifically with certain decisions to improve the regulatory infrastructure of the corporation. The document notes several examples where the company has been slow to address infrastructure needs.

Policies, Procedures and Limits

Wachovia's policies, procedures, and limits are generally comprehensive and are considered satisfactory. Policies and procedures cover all lines of business and are reviewed and approved by senior management. When tested, they have not shown major deficiencies that would increase the risks to the corporation. Limits established reflect management's measured risk appetite and are appropriate given their current business model. From a process perspective, improvements can be made in the area of commercial lending house limit exceptions which remain elevated. Policies and procedures in the area of market risk management are adequate at a high level, but written procedures appear to be falling slightly behind practice. The corporation's outsourcing/offshoring plans also will require the development of new processes and procedures to ensure appropriate risk management.

CONFIDENTIAL FCIC-134468 Restricted - F.R. Risk Monitoring and Management Information Systems

Wachovia's risk monitoring and management information systems (MIS) are satisfactory given the risk profile ofthe company, but further enhancements will be needed as the company expands its product offerings. High level senior management reports give a complete and accurate review of the key risks facing the corporation and include MIS for key projects. Financial reports provide a clear and transparent view of corporate performance and business line profitability. The assessment notes the need to improve trading book MIS. Currently the high level trading MIS captures risks and reports it in a timely manner; however, this MIS still lags expectations for an institution with Wachovia's activities. The previously noted CIB infrastructure issues have contributed to this deficiency. These issues are evident in the level of straight through trade processing which approximates only 50% to 70% of the transaction volume in CIB. The ability to capture and aggregate credit exposures will improve with the Risk Data Stratcgy (RDS) warchouse projcct.

Internal Controls

Internal controls are generally considered satisfactory. The lack of progress mitigating the proximity risk of the company's two data centers results in an operational risk internal control assessment of fair. Outside of this issue, senior management of the company has demonstrated a commitment to address weaknesses in the technology infrastructure. Controls for credit, market, and liquidity are considered satisfactory but manual processes are utilized in CIB trading which affects the internal control environment. Intemal audit and credit review are independent control functions which have had a positive impact on the internal control environment and the risk culture of the company. Noticeable attention is being focused on strengthening BSAIAML compliance across all parts of the company. Managcment is also making headway upgrading and strcngthcning numcrous tcchnology platforms which will have a positive effect on overall access controls. To date, cost reductions related to their efficiency initiatives have not negatively affected the company's control functions.

Credit

Credit risk management is satisfactory. Board and senior management oversight is effectively conducted through various executive credit committees. Wachovia has a well-developed credit approval process and maintains up-to-date, comprehensive credit policies online that clearly communicate risk parameters. Current systems and management reporting are adequate for traditional credit management purposes. While requiring manual intervention, full exposure levels for names are available in a reasonable time frame. Wachovia has recognized the need for an improvement in its MIS, givcn its incrcasc in sizc as wcll as the incrcasc in the array and complcxity of its product offcrings. Additional focus is being placed on data aggregation and concentration management with Risk Data Strategy (RDS), a high profile project to enhance data accuracy and reporting capabilities. Wachovia is also in the process oftransitioning to a less judgmental risk rating system. Credit Review and Internal Audit functions provide effective independent review of credit exposures and processes. Wachovia has done a satisfactory job of mitigating the risk of its current portfolio, primarily through loan sales and securitizations and CDS protection on single name exposure. At the same time, they recognize the need to increase the volume and sophistication oftheir portfolio management techniques. They have executed a synthetic HEUPEL securitization and are working to implement other portfolio management techniques including a synthetic CRE securitization and an active index hedging program.

CONFIDENTIAL FCIC-134469 Restricted - F.R. Market (Trading Book)

Market risk management of the trading book is satisfactory. There is an appropriate governance structure in place with independent market risk management, board designated management committees, and satisfactory information Hows to the appropriate levels of senior management. New products processes have strengthened during the past year with the formalization of procedures, proper representation on the New Products Committee, and improved product tracking after approval. Recent examination and Internal Audit results note that market risk management is improving and provides adequate oversight of trading activities. Market Risk Management as a group has enhanced their stature with stronger management and increased staffing. The 2005 hiring of Adam Litke to lead Market Risk Management coupled with new desk-level Market Risk Oversight staff additions, provides the institution with the foundation for overseeing current activities and their modest expansion plans. The market risk management practice enhancements arc occurring at a faster pace than traded risk, helping the institution to achieve a satisfactory rating.

Waehovia's infrastructure still needs work. Management information systems are fair and lag behind with delays in implementation of a more stable VaR system, the lack of P &L attribution at a granular level, only nascent desk -level reporting, and no centralized reporting infrastructure. In addition, policies and procedures are inconsistent and sometimes fall behind changing processes. Market Risk Management is aware of the weaknesses and is taking steps toward improvement, as well as implementing some compensating controls such as holding limits stable and close monitoring oftrading activity. They also ensure that senior management has sufficient data for informed decision making.

Market (Banking Book)

Risk management practices are satisfactory. Although management has unsatisfactorily handled the ALM5 Bancware implementation, the overall control environment is adequate. MIS accurately reports IRR exposure and an experienced staff is effective at working around current system limitations. While the existing process is timely and allows for limited analysis, management is aided by a fairly static balance sheet which yields predictable results. Additionally, an effective limit structure is outlined in the policy. Management regularly discusses model results in several forums and recent reporting changes evidence an engaged senior management team. BancWare implementation remains a deficiency. Poor project management has resulted in an implementation that has carried over two years. Management is confident they are now in the final stages, with a full EaR production planned for September 2006 and EVE by year-end 2006. Ongoing technical weaknesses with the software remain an impediment to success and staff is working closely with BancWare to fix these problems. Nevertheless, management acknowledges staff was strained and technology was inadequately integrated into the process from the outset. Regulatory criticisms are largely being addressed with the development of a Treasury Project Management Policy.

Liquidity

Risk management practices are satisfactory. A strong and experienced management team has developed comprehensive policies and reports to aid in governance of the liquidity function. Improvement to processes and reporting continue, especially through the Enterprise Funding Initiative (EFI). The EFI remains a prominent program to centralize liquidity oversight. Wachovia is an outlier in the use of hard dollar limits, but addresses this concern directly in the policy. Management has partially addressed deficient parent company contingency analysis through identification of possible subsidiary funding requirements, though parent company scenario analysis has not been completed. Management indicated it will incorporate the parent company into corporate contingency funding plans through completion of the EFI. Quarterly bank contingency funding analysis does capture the majority of funding activity and sufficiently stresses funding access with alternative funding sources identified.

CONFIDENTIAL FCIC-134470 Restricted - F.R. Operational Risk

Corporate operational risk management remains satisfactory. Management has taken steps over the past year that demonstrates a commitment toward improving risk management processes. Activities continue toward the implementation of the corporate operational risk management program. Management's efforts toward improving corporate governance and the risk management framework are being seen across the company through the involvement of strong functional oversight committees and ongoing refinement to the risk management program. The formation of the risk committees and their resultant products signal a heightened focus on assessing and understanding operational risk within the company. Management continues to ensure strong internal accounting and control processes through the financial governance initiative and the efforts to ensure sustained compliance with the Sarbanes Oxley Act. In addition, the Internal Audit function is considered satisfactory. As overall audit performance improves, management continues its efforts to promote the corporate stature and effectiveness ofthe audit program. However, we have noted areas for improvement with regards to operational internal controls including outsourcing and business continuity planning. These have been reflected in a fair rating in this element which is illustrative ofthe work within IT that remains to be completed.

Legal and Compliance

Legal and compliance risk is satisfactorily mitigated through effective risk management and controls. The board of directors and senior management has incorporated the importance of compliance into their culture and business strategies which has been communicated to the corporate compliance function and the business units. The committee structure in place allows for appropriate communication between the chief compliance officer and senior management as well as the board of directors. This enables senior management to appropriatcly address compliance risks to the corporation which is evidenced by the increased staffing in the AML office and utilization of consultants as needed. Policies and procedures have been approved, cover all major business areas and set appropriate limits consistent with the corporation's risk appetite. Risk monitoring and management information systems are sufficient in monitoring business and compliance risks including litigation. Notable improvements have been made with the implementation of the automated transaction monitoring system, Searchspace, and an issues tracking database which allows for central tracking and monitoring of outstanding audit, regulatory, and self-identified issues. We plan on reviewing their monitoring and testing practices to include control self assessments, compliance risk assessments, and the subsequent reporting to the board and senior management to assess its effectiveness this summer. Finally, the system of internal controls is satisfactory with strong reporting lines and an improved compliance audit function which is now considered satisfactory (previously rated fair).

CONFIDENTIAL FCI C-1344 71 Restricted - F.R. III. Detailed RAP Documentation

Credit Risk

Inherent Risk

Inherent Credit Risk Ratings

PORTFOLIO CHARACTERISTICS: Moderate

PORTFOLIO QUALITY: Limited

The portfolio mix has historically been more commercial than retail and was 58% to 42% (commercial/retail) at year end 2005, but the recently announced acquisition of Golden West Financial will change that mix. Post merger, consumer loans/total loans will increase to 62%, further diversitying the balance sheet into higher yielding, lower risk assets. In the meantime, traditional asset quality indicators do not reflect the recent increase in inherent risk, due not only to their lagging nature but also to their measure of residual vs. inherent risk. In addition, the bank's more extensive use of credit management techniques has helped to keep residual risk in check. Looking at portfolio quality from a number of angles shows that current portfolio quality poses low risk.

Portfolio distribution by credit rating is strong. On the retail side, while Wachovia has stated their intention to go out further on the risk/reward curve by dealing with customers with lower FICO scores, their FICO scores, refreshed quarterly remain very high. A recent report showed that 72% of the portfolio has borrowers with FICO scores over 700. In CIB, Wachovia continues to target both investment grade & leveraged borrowers. Investment grade debt is the larger part of the mix at 79%, with leverage loans (rated 5 and 6) remaining stable at 19% and criticized assets declining from 5% to 2%.

Traditional credit risk measures are stabilizing at very favorable levels after three years of steady improvement. These numbers compare positively to peers, admittedly aided by high collateralization and past lack of a credit card portfolio. Strategic improvements in loan portfolio management have had a beneficial effect on portfolio risk as well. Loans outstanding as of March 31, 2006, totaled $280.9 billion, for an increase of 8.5% as compared with year-end 2005. The commercial portfolio accounted for $3.7 billion of the $21.9 billion increase while the consumer portfolio accounted for $18.2 billion. This part of the increase was primarily driven by the addition of Westcorp ($13.3 billion), an increase in Residential Real Estate ($4.1 billion) and the repurchase of Community Reinvestment Act loans ($1.4 billion).

Commercial criticized outstanding (including net carrying values in LHFS) totaled 2.57% of commercial and LHFS as of March 31, 2006. This represented an increase of$116 million as compared with December 31, 2005. New additions to the Special Mention category were the main driver of this change. There was no impact to commercial criticized as a result of Westcorp. Criticized assets increased to 2.58% in April. Nonperforming assets (including AHFS and foreclosed property) were .28% at year-end 2005, aided by assets sales during the quarter. First quarter showed nonperforming again at .28% (due to purchase accounting treatment, the Westcorp merger added only $7MM.) NPAs showed a slight up-tick in April 2006 to .30%, but are projected to remain relatively stable during 2006. Both full year 2005 charge-offs and first quarter 2006 charge-offs were 0.09%.

CONFIDENTIAL FCI C-1344 72 Restricted - F.R.

Based on the cushion between the level of economic capital and tangible common equity (TCE), there is sufficient capital to support the level of credit exposure. Credit risk capital ($10.4 billion) is primarily attributed to wholesale and retail exposures and represented 53% of economic capital ($18.1 billion after diversification), which is well under TCE of $26.4 billion.

(See also CREDIT CAPITAL under CREDIT RISK MANAGEMENT AND CONTROLS.)

LOSS PREDICTABILITY: Limited

Expected losses for their existing portfolio are generally predictable. Internal risk ratings are driven off PDs and LGDs. Since Wachovia is in the process of transitioning to a less judgmental rating system, it has not been tested for accuracy in a down cycle. The commercial portfolio is weighted toward investment grade credits. This makes the accuracy of predicting default and loss rates in this portfolio less complicated than it would be otherwise. Wachovia's KMV weighted average EDF was 39bp at March 31, 2006, down 1 bp since February. Its median EDF at 6 bps, remained at a record low. (By comparison, KMY's overall population's median EDF was 47 bps, with median EDF for BB and B-rated credits at 13 and 52 bps, respectively. KMV's population would include all publicly rated companies.)

While the consumer portfolio historically has been more traditional/predictable, the proliferation of new mortgage products and the reported overvaluation of real estate in certain regions provides a challenge for predicting losses in that portfolio. That being said, until the acquisition of Golden West, the volume of new mortgage product business was not large. In addition, Golden West's historical credit track record has been strong, with peak losses at a low 18bps in 1994 (following a meaningful downturn in California real estate). Golden West's losses have averaged essentially Obps since 1998 (versus 13 bps on average for the industry). Prior to the announcement of the Golden West acquisition, Wachovia management had estimated that a stress-case scenario of a housing collapse would only represent $250-300 million in higher losses over three years.

Even with its acquisitions and re-entry into the credit card business, management does not foresee any events that should change the current stable environment for at least another 6 months. Current full year 2006 projections are .16% with external guidance currently .15%-.25%. As stated earlier, the first quarter charge-offs ratio was .09%.

MATURITY OF CREDIT BUSINESS / PRODUCTS: Limited

Generally, credit risk exposures reside in mature, stable markets and products. Wachovia has started offering, prompted by competition, some new liberal first mortgage products as well as interest-only home equity loans, but the volume is low. In addition, it is also entering some product areas, such as sub-prime lending and credit card direct issuance that are new to Wachovia. Mitigating some ofthis new product risk is acquired knowledge through its acquisition of Westcorp that specializes in sub-prime lending or putting in place senior management that has experience with the new products.

EXPOSURE TO SPECIALIZED BUSINESS LINES: Moderate

While Wachovia's portfolio is predominantly traditional commercial and consumer credit products, there are some specialized products on their books, such as asset-based lending and commercial real estate, together making up about 27% of the total loan portfolio. Wachovia has about $38 billion of ABL, made up of exposure from legacy Wachovia, Congress Financial, and ABL booked in the General Bank, representing 12% of the portfolio. CRE committed exposure at YE was $47.6 billion, representing 15% of portfolio composition, versus a peer average of only 6%.

Waehovia Capital Finance desires to be the preferred provider of financial solutions for businesses utilizing asset based lending within the Wachovia franchise states and the national turnaround and corporate ABL market. Target market generally includes prospects that will provide strong, long-term lending relationships for Wachovia and/or capital markets opportunities. WCF will generally not finance sub-prime commercial paper, construction companies, emerging and high-tech companies, startup situations, conflict of interest situations or borrowers involved in significant, serious litigation.

Efforts are underway to unify Wachovia's asset-based lending businesses, legacy CFC and legacy Wachovia ABL

CONFIDENTIAL FCIC-134473 Restricted - F.R. under the name Wachovia Capital Finance. Both legacy units function under established credit cultures that maintained an appropriate balance between quality and growth. The turnaround segment of the portfolio has a potentially higher risk of borrower default than a traditional commercial loan portfolio but a correspondingly lower risk ofloss due to the collateral and structural controls.

Waehovia's CRR has consistently assigned satisfactory ratings for each credit process (underwriting documentation, underwriting analysis, servicing documentation, servicing analysis, FDG accuracy and LGD accuracy) in recent quarterly reports. June 30, 2005 Unit Level Summary for Internal Audit assigned an unsatisfactory rating for legacy CFC's 2Q04 audit, noting a pervasive pattern of internal control breakdowns. A follow-up audit conducted in lQ05 concluded that the issues had been adequately addressed and an overall satisfactory rating was assigned. Legacy Waehovia ABL has not been audited since 4Q02. A planned 2005 audit was postponed due to the consolidation of the two units. WCF will be audited in 3Q06.

CRE is another specialized product and is highly sensitive to national macroeconomic factors as well changes in local and regional economies. Waehovia targets national and regional developers among its income property clients and generally focuses its CRE lending in markets within its geographic footprint as defined by the location of its retail banking offices. In 2004 and 2005, Wachovia expanded to several locations outside this footprint, reportedly driven more by following existing clients into these new markets, rather than development of new relationships. Source of repayment for income properties is generally expected to be permanent refinancing, although Wachovia may finance the properties using its own balance sheet. REFS relationship managers often assist clients in obtaining permanent financing, which may be accomplished by arranging private placements or via CREF's conduit. Source of repayment is well diversified given the broad geographic footprint and variety of regional and local economies.

Given CRE's distinct credit characteristics in terms of probability of default, loss given default, CRE will have a series of credit grading scorecards. An initial round oftesting has been completed for the following sectors/product types: income property, office retail, multifamily, industrial, land, A&D, AD&C, condominiums, multifamily, builder lines of credit, residential, and borrowing base lines.

CRE's credit quality statistics are satisfactory. After some initial deterioration with the integration of the SouthTrust portfolio, credit quality statistics have improved. As of9-30-05, the weighted average FDG was 5.5. Charge-off experience has been favorable and improving over the past few years with net charge-offs amounting to 8bps in 2002, 2 bps in 2003 and less than 1 bp in 2004-Jun 05. Other credit quality statistics for the overall portfolio as of 12/31/05, compared to goal:

Actual . Corp; Stds. Criticized 1.22% 3.00% Classified 0.74% 1.25% Past Dues 0.05% 0.50% NPAs 0.10% 0.40%

For the entire portfolio, CRR has consistently rated all aspects of REFS' credit management processes as satisfactory, although there have been isolated instances where some sub-portfolios (e.g. geographic regions) received less than satisfactory ratings. Internal Audit's findings also do not suggest any significant changes in risk levels, rating the unit Satisfactory. Past OCC examinations have disclosed no material weaknesses in REFS underwriting analyses which arc documented within the General Bank's CA Tools application. Sensitivity analyses of projections arc routincly included in the underwriting package.

MARKET LIQUIDITY OF CREDIT RISK EXPOSURES: Moderate

Most credit risk exposure on Wachovia' s books has liquid secondary markets and the company has made a concerted effort to implement an "originate to distribute" philosophy. Several areas keep track of deals done in the market to make sure that Wachovia has institutional market knowledge and that its new deals are priced and structured so as to make them marketable. An example of this would be the weekly reports produced for the leveraged loan area, giving a market update, detailing weekly statistics on volume, pricing trends. A similar report is also produced on the investment grade loan market. "Market Update" is published weekly by the Portfolio Strategies team in Credit Risk Management, bridging a view on what is rclevant each week externally, while also touching on key credit metrics internal to Wachovia for the week.

CONFIDENTIAL FCI C-1344 74 Restricted - F.R.

USE OF CREDIT RISK MITIGANTS: Moderate

Credit mitigation activity at WB is growing both in volume and sophistication. WB makes use of credit mitigants at both the line of business level and at the corporate credit risk management level. As of March 31, 2006, the Public Portfolio Management Group had purchased $4 billion notional CDS to hedge a CIE portfolio of over $16 billion in outstandings and $80 billion in commitments. Overall, Wachovia had a net position of $4.9 billion in CDS, offsetting a C&I portfolio of over $47B in loans. That amount of coverage is smaller than WB's peers who are extensive users of credit derivative protection and alludes to WB's learning curve.

Waehovia has implemented an Index Hedging Program to reduce event risk and completed one small transaction under the program. They have also executed a $9 billion HELIPEL synthetic securitization. Wachovia is contemplating a commercial real estate synthetic CLO to reduce concentration and build distribution infrastructure as well as a corporate credit synthetic CLO to address excess and other large single name exposures at the portfolio level. A new Portfolio Management Committee (PM C) has been formed with members of both CIE and CRM to move the Public Portfolio Management group to a more active credit management role.

(See also CREDIT RISK MITIGATION and PORTFOLIO MANAGEMENT AND REPORTING.)

PORTFOLIO SEASONING: Moderate

While most of W aehovia' s portfolios are mature, they are expanding their product offering. Some of the products are new to Waehovia (such as sub-prime lending) and re-entry into credit cards. Others, like some of the newer mortgage and home equity products, are new to the market. They pose additional risk as their periormance has not been tested in an economic downturn. Even with the newer products, Wachovia has tended to be conservative in their adoption. 60% of the market's home equity lending is variable rate. Only 30% ofWachovia's home equity lending is at variable rates. While variable rate home equity suggests less interest rate risk to banks, it also suggests more credit risk. If that is so, Wachovia's credit risk arising from their home equity product may be less than that of some of their competitors, such as BAC, where variable rate represents 86% of their home equity lines.

LUMPINESS: Low

Waehovia's house limits are designed to prevent lumpiness in the portfolio (see CREDIT RISK CONCENTRATION section below). In addition, CDS hedges help to reduce booked excess. March summary statistics show 380 pass grade relationships with excesses after CDS Hedge. (It should be noted, however, that 249 were GBG relationships where the exposure guidelines are only $2.5 million.) The Weighted Average (WA) Facility Default Grade (FDG) of these excesses was 4.5 with the WA LGD of 4 (25%) and WA Tenor of3.8 years. The largest exposure at Wachovia is $1.8 billion to Barclays Bank pIc (l.5 FDG).

CREDIT RISK CONCENTRATION: Moderate

House Limits (sec LIMITS section below under POLICIES AND PROCEDURES) arc designed to protect Wachovia from excessive exposure to a single borrower/ relationship while concentration guidelines are designed to protect Wachovia from excessive credit exposure to any single industry or real estate product type, facilitating diversification of risk. House Limits have been established for maximum notional loan exposure and maximum pre-settlement risk exposure to any customer relationship, based on its WA FDG. Credit risk economic capital-based triggers for a customer relationship have also been established. Transactional risk exposure is not subject to house limits, but is governed by authority delegation.

House limits are established for CIE and Congress Financial separate from those for the GBG, Wealth Management and Parent segments. In addition, separate house limits have been established for asset securitizations and emerging market banks. All extensions of credit are subject to the house limits of the appropriate line of business. Credit decisions by special assets management or the special situations group pursuant to a workout of criticized assets arc exempt from the house limit approval requirements.

House limits are conservative. For example, within CIE, the notional loan limits range from $600 million for a 30

CONFIDENTIAL FCI C-1344 7 5 Restricted - F.R. transaction with a weighted average FDG of 1.5 to $50 million for a FDG of 6.2, $35 million for a 6.5 ($50 million for Congress), $25 million for a 6.8 and $10 million for 7.2 and worse ($50 million for Congress). The credit risk economic capital trigger for CIB is $4 million. GBG, Wealth Management Group and parent house limits are even lower: ranging from a notional loan limit of $400 million for a 1.5 FDG to $50 million for a 5.8, $35 million for a 6.2, $25 million for 6.5, and $10 million for a 6.8 or worse. Their credit risk economic capital trigger is only $2.5 million for this group. These conservative limits, while generating a number of exceptions, are responsible in large part for the absence of major concentrations among obligors.

Industry guidelines have been established for 61 industry segments and 10 real estate product groups and managed with the goal that notional loan exposure and credit risk economic capital within an industry segment or real estate product type will be less than 3% oftotal wholesale notional loan exposure and credit risk economic capital. Whenever a segment exceeds 5% of credit risk economic capital, a plan has to be developed to reduce credit risk economic capital below 5% or an exception is to be explicitly approved. If definition real estate exposure exceeds 20% of credit risk economic capital, a plan has to be developed to reduce it below 20% or an exception has to be explicitly approved.

For the month of March, eight industries were over the 3% Capital watch guideline, yet all were still under the 5%. These were Non-residential Real Estate, No-DefRE, Apartments, Non-depository institutions, Other Manufacturing, Condo/Single Family, Retail, and Office Buildings. The number of industries over the 3 % Exposure guideline was 7. Of note, exposure in the REIT category decreased and in now within guideline. Remaining were Public Administration, Non-DefRE, Depository Institutions, Condo/Single Family, Non-depository Institutions, Health Services and Individuals.

Real Estate remained over the 20% capital guideline at 23.9% of commercial EC (23.6% of commercial exposure). Although CRE represents a concentration, within this concentration careful customer selection has helped to provide diversity by region and product type. Florida at 27% oftotal commitments as of June 30, 2005, represents the largest geographic concentration. Single-family homes represent the single largest REFS concentration, with 17% oftotal commitments, while apartments are the singe largest income property concentration at 14%. Product mix in concentrated in construction lines of credit and mini-perm term loans. The acquisition of SouthTrust resulted in a 38% increase in CRE exposure, adding about $11 billion in commitments as of year-end 2004, but added markets in Alabama, Texas, and Arizona. While the acquisition of Golden West is projected to boost Wachovia's residential real estate exposure to 24% of revenue (versus 7% stand alone), Wachovia's risk is in line with peers given Wachovia's average LTVs on home equity is among the lowest in the industry, its FICO scores are above average and 70% of home equity is in first lien (versus 30% for the industry). To manage future growth, Wachovia is also planning ways to reduce CRE credit risk, such as a CRE synthetic CLO to reduce concentration and build distribution infrastructure.

Wachovia management has estimated that a stress-case scenario of a housing collapse would represent $250-300 million in higher losses over three years.

GROWTH IN VOLUME / PROFITABILITY: Considerable

Wachovia's outlook for 2006, prepared prior to its Golden West acquisition, shows aggressive growth in both volume and profitability. Loans are projected to grow in the mid-teens percentage range from an adjusted $240.6 billion, including consumer loan growth in the high teens from an adjusted $107.9 billion and commercial loan growth in the low double-digit range from an adjusted $132.7 billion. Net interest income growth was projected in the low singlc digit percentage range on a tax-equivalent basis from an adjusted $14.6 billion.

MARKET LEADER OR FOLLOWER: Moderate

Wachovia is more often a market follower in terms of product introduction, but tends to be in the top provider segment for many of its products. For instance, Wachovia is the #1 middle market lender in its footprint and the #1 US CMBS loans contributor and master servicer. In other areas, Wachovia is among the: • Top 12 nationwide mortgage lender (with its position to be enhanced with the Golden West acquisition) • Top 3 in nationwide real estate financial services • Top 3 in leveraged loan syndications and US collateralized debt obligations • Top 3 US asset-based lending lead

CONFIDENTIAL FCI C-1344 7 6 Restricted - F.R.

PORTFOLIO STRATEGY: Considerable GROWTH GOALS AND POTENTIAL SOURCES OF NEW LOANS: Considerable GROWTH OUTSIDE THE CURRENT MARKET: Considerable NEW PRODUCTS, BUSINESS LINES OR CLIENTS: Considerable In 2005, average net loans increased 32% from 2004 to $227.9 billion, due to the SouthTrust impact. Average consumer loan growth of 31 % was led by real estate-secured loans, including the effect of a net $9.3 billion of primarily home equity lines transferred from loans held for sale to the loan portfolio in the fourth quarter or 2005. Average commercial loan growth of34% reflected strength in middle-market commercial and large corporate lending.

Following on this growth, Wachovia has aggressive growth plans for 2006. With recent acquisitions, they will have growth outside their current market as well as in new products. Their acquisition of Westcorp offered both an opportunity to enter the sub-prime lending market and to expand further in the California market. To expand its mortgage lending in the New York City area, Wachovia agreed to buy American Property Financing Inc., the top ranked agency multifamily lender in the New York area, from Emigrant Bank. Their recently-announced acquisition of Golden West, which is not expected to close until the end of the year, will expand their geographic footprint to cover 55% of the US population.

CONFIDENTIAL FCI C-1344 77 Restricted - F.R. Credit Risk Management and Controls

Credit Risk Management and Controls

BOARD OF DIRECTOR AND SENIOR MANAGEMENT OVERSIGHT: Strong

BOARD GOVERNANCE, STRUCTURE AND OVERSIGHT: Strong

The Board of Directors is responsible for delegating and annually reconfinning the authority of the CEO to approve credit up to the legal lending limit of each Wachovia bank. The CEO is empowered to further delegate this lending authority. Only an authorized officer with sufficient delegated credit approval authority for the level of risk contemplated is pennitted to incur credit risk. Approval authorities are tiered relative to an oUker's position in the hierarchy, with junior officers having lower approval authority, which may require higher-level concurrence to commit to particular exposure levels. The corporate credit policy establishes house exception limits and concentration policies to manage concentration risk.

The Senior Risk Committee (SRC) is appointed by the Board of Directors to approve and implement the risk governance structure for the company, monitor the direction of risks relative to business strategies and market conditions, identify emerging risk and direct actions to mitigate those risks as it deems appropriate, incorporating the mitigation efforts into the strategic planning process.

SENIOR MANAGEMENT GOVERNANCE, STRUCTURE AND OVERSIGHT: Strong OWNERSHIP RELATIONSHIP fRISK! PORTFOLIO MANAGEMENT ROLES: Satisfactory

Wachovia's risk management strategy is aligned around four components of risk governance, each with a specific role:

• Business units are responsible for identifying acknowledging quantifying mitigating and managing all risk • Independent risk management function (joined by other corporate staff functions such as legal) provides objective oversight of risk-taking activities and translates overall risk appetite into approved limits. Credit Risk Review reports administratively within Risk Management but directly to a committee of the Board. • Internal Audit, which reports directly to the Audit Committee of the Board of Directors, provides an objective assessment of the design and execution ofWachovia's internal control system and risk committees • Risk committees provide a mechanism to bring together the many perspectives of the management team to discuss emerging risk issues, monitor risk taking activities and evaluate specific transactions and exposures. All risk committees ultimately report to the Senior Risk Committee. The Senior Risk Committee directly oversees the activities of the Credit Risk Committee, along with the other four key management committees, Market Risk, Operational Risk, Asset and Liability, and Conflicts ofInterests.

NEW PRODUCT APPROVAL: Strong

Waehovia has a corporate policy addressing New Products. The policy provides for the creation and operation of a New Product Committee in each of the five major business segments. Any new products, or changes in existing 33

CONFIDENTIAL FCIC-134478 Restricted - F.R. products that would materially alter their risks, require the approval of the New Product Committee. These committees are responsible for thoroughly examining the associated risks. New Products committees are required to report on their activities at least quarterly to the ALCO Committee, which is responsible for reviewing and approving, prior to implementation, any new product or any material change to existing products that could have a significant impact on the corporation's liquidity, capital, market risk, or pricing.

POLICIES, PROCEDURES AND LIMITS: Satisfactory

POLICIES AND PROCEDURES: Strong

Lending policies are consistent with Waehovia's overall strategic direction and tolerance limits. The Risk Committee ofWachovia's directorate review and the Senior Risk Committee review and approve the broad credit risk governance for the bank. The Risk Committee annually reviews major changes to credit policy. The Credit Policy Committee reviews and approves new policies and changes originated by the Corporate Risk Policy Department or by business units engaged in credit activities. The Corporate Risk Policy Department is responsible for determining which policies are presented for approval to the Credit Policy Committee. The Credit Risk Committee approves certain high-level enterprise policies.

Policies are easily accessible by lending staff on the Wachovia intranet system, Risk Policy Online (RPO) contains all applicable lending policies. Recent revisions are also readily available on the RPO application. House limits are based on notional amounts and economic capital that is driven by risk rating. Infractions are reported at the top ofthe house.

LIMITS: Strong

To achieve the minimum desired diversification for their credit portfolio, Wachovia has established House Limits for maximum notional Loan Exposure and maximum Pre-Settlement Risk Exposure to any customer relationship based on its Weighted Average Facility Default Grade. Credit Risk Economic Capital-based triggers (which include both Loan and Pre-settlement Exposure) for a customer relationship have also been established. Transaction Risk Exposure (TRE) is not subject to House Limits, but is governed by authority delegations.

Limits are established separately for Corporate and Investment Banking and Capital Management from those for the General Banking Group, Wealth Management and Parent segments. In addition, separate House Limits have been established for Asset Securitizations and Emerging Market Banks. All extensions of credit arc subject to the House Limits ofthe appropriate line of business.

In addition to approving the maximum credit exposure to individual commercial borrowers or related group of borrowers, the Credit Risk Committee approves limits as well as for industry concentration and country exposure limits.

(See also CREDIT CONCENTRATION section.)

APPROVED EXCEPTIONS TO POLICY ITOLERANCE: Satisfactory

Aggregated exposure to any customer relationship which exceeds the House Limit for the Notional Loan Exposure amount, the Pre-Settlement Risk (PSR) amount, or the Credit Risk Economic Capital amount must be documented as a House Limit Exception and approved by the Chief Risk Officer or designee and, ifrequired, senior Line of Business manager. This exception approval process must be repeated whenever the exposure increases. New exceptions to House Limits and trend data are reported to the Credit Risk Committee quarterly and to the Risk Committee at least semi-annually.

While the processes are Satisfactory, there is an increasing level of commercial house limit exceptions. Part of that is driven by the increased role that Wachovia is playing in the syndications market for investment grade credits that requires their taking larger initial positions. Another driver is the modest level of limits in place, e.g., the notional loan exposure limit for CIB is $600 million for FDG 1.5 and for GBG is $400 million. Their credit risk economic capital trigger is only $2.5 million for GBG and $4MM for CIB. 34

CONFIDENTIAL FCI C-1344 79 Restricted - F.R.

This increasing trend of exceptions has been discussed with Wachovia management who recognizes the need to address it. The minutes ofthe March 27, 2006 meeting of the Credit Risk Committee Minutes formally noted that limit policies, both single name and industry concentrations, are in the process of being reviewed. We, as well as our OCC counterparts, see this as an area that needs to be focused upon from a supervisory standpoint. (Notes to address vetting comments: The reviewer feels that the rating is appropriate, not because the limits are being reviewed but because they are approved according to the Limits Policy.)

(See fuller discussion above in CREDIT CONCENTRATION section.)

CREDIT UNDERWRITING: Satisfactory

Wachovia has had to respond to the increasing competition and liquidity in the syndicated market. The result has been more deals underwritten with higher total leverage and/or heavily back-ended repayment programs. They have tried to mitigate this risk by limiting hold levels. As part of the SNC program, the OCC is collecting information on SNCs sampled that were underwritten in 2005, seeing what underwriting standards may have been relaxed. The results of that will be reviewed and discussed with Wachovia.

Middle market and commercial real estate lending standard are also under pressure. An August 2005 Credit Review finding was that Wachovia was "stretching" on approximately 15% ofloans sampled. The OCe's target reviews have generally concluded, however, that underwriting is satisfactory.

On the retail side, much of the underwriting is automated. Models and policies are incorporated into computer programs or "decisioning engines". Once the retail loan is extended, it is included in the overall portfolio, which is continuously monitored for changes in delinquency trends and other asset quality indicators. The currently high FICO scores have been discussed earlier, as has the possible impact of the bank expanding its credit universe, testing lower FICO scores to maintain growth, the addition of sub-prime lending through its acquisition of Westcorp, and its re-entry into the credit card issuer business.

Various systems such as CATools, Portal, Application Handler) document and place controls over the underwriting process. Reviews by the OCC have found these systems satisfactory. The OCe's RAD examiners have reviewed the scoring systems and found the processes satisfactory.

CREDIT APPROVAL: Strong

The Bank has a very good credit culture which is embodied in its processes. There are two processes for approving credit risk exposures, both of which are "owned" by risk management who is segregated from the production process and engaged in underwriting, credit approval and servicing activities.

The first involves standard approval structures (such as rapid decision scorecards) for use in retail, certain small business lending and most trading activities. Custom scores combined with FICO scores drive the decision process, with overlays for DTI and credit bureau derogatories. There are loan amount and LTV matrices based on custom score. Approval hierarchies for loan amount, overrides and other exceptions are in place and imbedded in underwriting system.

The second approach involves individual approval of commercial exposures. Since credit approval authorities are "tiered", larger and riskier exposures require a greater level of authority, which brings the necessary experience and discipline to the process. Authority to approve credit exposure up to the legal lending limit of each Wachovia bank is granted to the Chief Executive Officer ofWachovia Corporation by the board of Directors and is reconfirmed annually. The Chief Executive Officer is further empowered to delegate approval authority as necessary and appropriate through the Chief Risk Officer and the Risk management Group.

Consumer credit approval authority is recorded and tracked in the Application Handling (AH) system.

CONFIDENTIAL FCIC-134480 Restricted - F.R. Commercial credit approval authority is used to underwrite, approve and manage the risk in a given exposure to a commercial customer or relationship as detailed in the exposure and house limits policies. No credit exposure may be incurred, no commitment issued, nor existing exposure renewed or modified, until approval from an individual with the appropriate type and level of authority has been obtained. In addition to the types of authority, transactions subject to certain policies require further approval, e.g., Reg a policy, the house limits policy and product-specific policies such as types of definition real estate or underwritten syndicated loans.

Authority is based on the Facility Default Grade (FDG), only for transaction for which the individual has responsibility, and approvers must have authority for the transaction on a standalone basis as well as authority for the aggregated exposure and weighted average FDG.

RISK MONITORING AND MANAGEMENT INFORMATION SYSTEMS: Satisfactory

CREDIT INFORMATION TECHNOLOGY SYSTEMS: Satisfactory

Wachovia has in place adequate credit IT systems for traditional credit management purposes. While requiring manual intervention, full exposure levels for obligors are available to senior management in a reasonable time frame. MIS to credit risk committees includes credit quality metrics, loan syndication and credit mitigation information, large and excess exposure reports, along with market information

With its products increasing in array and complexity, Wachovia recognizes that it needs to make improvements to its MIS. Wachovia is designing and implementing a strategic risk information management environment (RIME). The Risk Data Strategy project (RDS) will deliver the RIME. The first phase of the strategy will focus on credit risk information to prepare Wachovia for compliance with Basel II. Ultimately, the risk information environment will encompass credit, market, operational and interest rate risk data and will provide more accurate and consistent data for management decision-making across the company. RIME includes a new data warehouse and associated technologies and business processes. The new environment will provide efficient comprehensive storage and analysis of massive quantities of data while improving the ability to trace and reconcile information. Data will be consistently defined and will aggregate across business lines.

RIME will: • Satisfy near-term data needs for Basel II compliance • Bring together all retail and commercial credit risk data into a single repository and will equip end-users with the tools and support to easily access all this information • Provide the majority of data required to enable a view of the full customer relationship across the company • Position Wachovia to achieve better risk management practices as well as enhanced customer service, target marketing and cross-selling opportunities

RDS is still identifying gaps but was moved from yellow (at risk) status to Green as final funding was approved and all major deliverables and processes got back on track. We, along with the acc, will continue to monitor progress on this critical project as slippage would seriously jeopardize other projects and future MIS improvements.

CREDIT RISK RATING SYSTEM: Satisfactory

The Grading Systems Committee is a subcommittee that reports to the Credit Policy Committee and ensures that grading systems throughout the corporation are equitable and produce default rates and loss given default rates that are in line with historical results. Wachovia is transitioning to more transparent, less subjective scorecard to improve consistency and grading accuracy. Ernst & Young worked with Wachovia in the development of their new scorecard system. The primary purpose of the grades is to assist in the evaluation of risk and pricing, the management of individual facilities and relationships, as well as the portfolio as a whole. There are three different grades: the borrower default grade that measures the relative strength of the legal entity borrower; the FDG that measures the expected default frequency of the subject facility; and the LGD grade that measures the average amount ofloss over a given economic cycle that can be expected if the facility defaults.

The Borrower Default Grade is established first. The Borrower Default Grade worksheet allows for a relatively structured assessment of risk for C&I borrowers by requiring that each of seven determinants be individually "graded" 36

CONFIDENTIAL FCIC-134481 Restricted - F.R. with a one-digit grade. The seven detemlinants that are assessed are: Industry/Industry Segment, Position within Industry, Eamings/Operating Cash Flow trends, Asset/Liability Values, Financial FlexibilitylDebt Capacity, Management and Controls, , and Financial Reporting. Short narrative descriptions provide guidance for this grading process. Those determinants are then weighted in order to arrive at a two- digit Borrower Default Grade. The 2nd digit of 2, 5, or 8 is used to provide more granularity or risk (i.e., the strongest 5X borrowers will be graded 5.2, average will be graded 5.5 and weakest will be graded 5.8). The weighting is subjective and will vary depending upon a borrower's specific circumstances.

The Facility Grade Worksheet allows for calculation of both the FDG and the LGD Grade. The FDG calculation is relatively objective and will often be the same as the Borrower Default Grade but need to take into consideration any Liquid Collateral/Letter of Credit or Strong Guaranty/Third Party Support. The LGD grade is established by independently and objectively assessing the average percentage ofloss that could be expected ifthe facility were to go to non-accrual. The calculation consists of aggregating point values from collateral, guaranty/third party support and the original Borrower Default Grade. All commercial borrowers require a Borrower Default Grade and all facilities require a FDG and a LGD grade. The appropriate Borrower Default Grade Worksheet and Facility Grade Worksheet are required for all borrowers/facilities to document the grading process.

Generation 1 to the new scorecards included scorecards for core C&I, CRE and individuals. C&I included a scorecard for core public and private industries as well as special scorecards for Broadcasting, Healthcare, Power/Utilities regulated and Retail type services. CRE scorecards were designed for income producing (Multifamily, Retail, Office and Industrial), SF Residential (Land, Acquisition and Development, Acquisition, Development and Construction, Builder Lines and Borrowing Base) and condominiums. Scorecards for individuals were broken down into Non-CRE (High Net Worth and Generic) and REFS. These scorecards are expected to be rolled out in July 2006.

Generation 2 includes scorecards for additional segments (Asset Securitization-seller servicers, Dealer Financial Services, Financial Institutions, Not-for-profit hospitals, Municipals, Not-for-Profits, Higher Education, Religious organizations, professional practices, Sovereigns) as will as segmentations to Gen 1 scorecards (Healthcare, Hospitality, and Multi-asset entities under CRE Income Producing; Land under CRE Residential; and Intemational Corporates and Small Business under C&I.)

The OCC's draft of their supervisory plan for 2007 includes (under target supervision of Basel II) a Risk Rating Replication Review designed to help determine ifWachovia's new risk rating system, driven by scorecards, has adequate controls on the accuracy of inputs, conformance with policy and controls on override practices . We expect to participate in that as well.

ONGOING CREDIT ANALYSIS: Satisfactory

Wachovia recognizes the need to perform credit analysis not just at the initial underwriting. The borrower's risk profile, financial condition and operating performance are regularly assessed to ensure the accuracy of the borrower's risk rating. This assessment also includes the borrower's position within its industry. Repayment capacity under different economic scenarios, primarily for non-investment grade borrowers, is reviewed. The procedures for ongoing credit analysis are different in GBG and CIB.

Each credit relationship managed within the GBG Commercial, business banking or community banking segments or within the Wealth Management Group is serviced in CAToois and must have a defined servicing plan. The goal of servicing is to confirm that the sources of repayment remain viable, that the key risks identified are relevant and that grades are accurate. The frequency of analytical servicing and servicing docU111entation needed is determined based on business segment profile, relationship credit risk, economic capital and total exposure.

All CIB hard dollar credit exposures art required to have a documented servicing plan. The frequency of the "scheduled" servicing, whereby the portfolio manager is expected to prepare a servicing memorandum depends upon the Borrower Default Grade. In addition to the scheduled servicing events, the portfolio manager is expected to perfonll on-going monitoring using the established "Alerts" process. The alerts are based on the triggering of pre established thresholds. For publicly-held companies, the trigger basis is equity price movement or rating agency ratings changes. For privately held companies, various performance measures serve as the trigger basis.

CONFIDENTIAL FCIC-134482 Restricted - F.R.

Servicing and monitoring processes are usually appropriate. As mentioned above, several operational changes focused on improving tum time and reducing servicing intervals, such as the end-to-end process in GBG and the implementation of portal in CIB, need to be monitored closely to make sure that ongoing credit analysis does not sutler.

PORTFOLIO MANAGEMENT & REPORTING: Satisfactory

Credit risk mitigation has been managed to date primarily through loan sales and securitizations, but recently has evolved to use credit derivative products as well. Deals done are adequately reported in a number of MIS packages, such as the CRPC package, CRC package, CIB Risk Return Committee package to be reviewed by Senior Managcmcnt.

In CIB, a portfolio management subgroup, Credit Products, is charged with trimming excess exposures and limiting concentration risk in the large corporate portfolio. Besides housing the investment grade and leveraged finance syndication desks and the special situations group, Credit Products also houses the Public Portfolio Management Group. This group enters into short-based CDS positions to offset exposure. A separate group called Private Portfolio Management focuses on the traditional ways and means of credit portfolio management through sales of problem loans in the portfolio.

For the GBG portfolio, the centralized corporate risk management group is responsible for taking corrective action. The risk management group can also mandate the use of CDS to hedge credit exposure on a top down basis.

(For more details, see comments under CREDIT RISK MITIGATION and USE OF CREDIT MITIGANTS sections.)

COUNTERPARTY CREDIT AND PRESETTLEMENT/SETTLEMENT RISK MANAGEMENT: Fair

During the fourth quarter of2005, the OCC conducted, with the Fed's participation, a review ofWachovia's counterparty credit processes and hedge fund activities. The exam focused on controls over trading counterparty exposures, including credit approval processes, exposure calculation methodologies (models), margin and collateral management, counterparty credit MIS (Systems and reporting), legal documentation management, and BASEL II implementation issues. The conclusions were:

• Overall counterparty credit processes need improvement as numerous infrastructure and control function weaknesses were identified. • The aggregate level of credit risk from counterparty exposure is reported to be in the low to moderate range, but is based on calculated exposures that cannot be fully verified due to MIS limitations and the lack of reconciliation processes. The current system, STIERS, cannot capture the complexity of the various products that pose counterparty risk, leading to an unreliable estimate of exposure and a lack of full reconciliation to source systems. Management has recently chosen SunGard' s Adaptiv system to replace the current system, STIERS, and has approached the Project Management Office to ensure appropriate focus is given to the implementation. Management is confident Adaptiv is capable of meeting Wachovia's needs and is flexible enough to add products in the future. • Staff assigned to counterparty credit processes are competent and capable, but have been hindered due to inadequate staffing support. • Project management practices need to be addressed • CIB Risk Management needs to develop an effective self-assessment process.

Management has written a formal response to these concerns noting that enhancements to the overall process over the next 18-24 months should resolve the issues. We have not yet had fonnal meetings with management since the letter was issued, but will follow-up on these concerns as part of the ongoing supervision process.

CREDIT RISK MITIGATION: Satisfactory

Wachovia has a dual approach to using credit mitigants, one at the line of business level (Public Portfolio Management) and the other in the corporate credit risk management function (CRM).

CONFIDENTIAL FCIC-134483 Restricted - F.R. Public Portfolio Management (PPM) has been mandated to support the CIB franchise by ensuring that CIB can deploy credit capital in pursuit of elient relationships through all stages of the economic and credit cyele. PPM supports CIB through active credit risk management, reducing the impact of credit losses in the strategic loan portfolio. The group has two main units: Credit Portfolio Manager Group and Portfolio Strategy Group.

The Credit Portfolio Manager Group is organized by industry and performs market-based analysis to determine possible credit actions. The Portfolio Strategy Group is more focused on taking an active role in credit management and houses some of the more complex models, including their Active Portfolio Construction (APC) model which estimates portfolio credit losses through the cycle.

The principal functions ofthe PPM group are to: • Devclop fundamental and value opinions for each sector and significant names in order to recognize negative credit migration in the early stages • Buy CDS protection on single name and sector exposures in the strategic loan portfolio that are at risk of negative credit migration • Buy CDS protection on concentrated single name and sector exposures • Recommend loan sales to Private Portfolio Management to combat migration and/or concentration risks where there are relative value or liquidity benefits versus CDS • Recommend macro-risk positioning of the strategic loan portfolio plus balancing activities (size, ratings distribution, tenor) to the Portfolio Management Committee • Invest in bonds, loans, CDS and other debt securities of names and sectors that are not concentrations

The credit risk mitigation function housed under the Credit Risk Management (CRM) is more focused on a bank wide hedging program to address the risks from a top down view. This group has also undergone some reorganization over the past few months. WB is increasing the headcount for this function and making it more active that it had been in its prior incarnation.

The CRM is focused on reducing the earnings volatility due to credit losses and improving the efficiency of regulatory and economic capital use. Their current priorities and hedge strategy for these priorities include:

CURRENT RISK PRIORITIES HEDGE STRATEGY

Event risk hedging Corporate Hedge Index Floating Rate Consumer Loan Portfolio Synthetic HELIPEL Securitization Commercial Real Estate Concentration Synthetic CRE Securitization Excess Exposure Relationships Excess Exposure SCLO Asset Quality Deterioration Migration Hedge

CRM is working in conjunction with the LOBs and Corporate Treasury on the bank-wide hedging program. In particular, CRM is working with Corporate Treasury to implement an Index Hedging Program to provide protection against 'event risk', as well as some level of systematic risk mitigation.

(See also PORTFOLIO MANAGEMENT & REPORTING and USE OF CREDIT MITIGANTS sections.)

CONFIDENTIAL FCIC-134484 Restricted - F.R.

PROBLEM LOAN MANAGEMENT: STRONG

Wachovia's problem loan management is strong. Wachovia's policy entitled 'Transfers to Special Situations Group or Special Assets Management" generally requires that loans rated FDG of 7 or worse (criticized) be transferred to the primary workout groups at Wachovia. For a criticized account to remain under line management, the credit weakness must not be severe and there should be a reasonable likelihood of it being upgraded to a "Pass" grade within a short period (usually six months). Retention of criticized loans by the line requires the approval ofthe unit's chief risk officer.

Thcrc are two primary workout functions at Wachovia. Thc Spccial Situations Group (SSG) manages thc criticizcd asset portfolio of Credit Products within the Corporate and Investment Bank. The group's objective is to maximize the value of the portfolio in a manner that is consistent with the overall goals of Credit Products and CIB. Among these goals are minimizing losses, reducing non-performing loans and credit capital and diminishing the volatility of the portfolio. The activities performed in the group relate to managing individual loans by employing workout and restructuring techniques. Most of the criticized assets that SSG manages currently are from Private Portfolio Management within Credit Products, but SSG is taking on an increasing role in the workouts and restructuring of criticized assets from other groups within the Fixed Income Division (FlO) and the Intemational Division. As of November 2005, SSG had 15 employees (9 principals, 3-associatesl analysts, and 3-operationslbusiness support). The last Intemal Audit Report of SSG rated the group Satisfactory and Internal Audit also rated overall inherent risk of this entity as LOW.

The SAM Units are the bank's regional workout group, which handle resolutions outside of the Capital Markets area. With each region, there are typically multiple teams at various locations. SAM credits are evaluated by CRR in the normal course of examination ofthe LOB. The purpose of SAM is to rehabilitate the individual credits where they can be returned to the relevant Portfolio Management Group for more normal monitoring; other options are to workout the credit exposure by foreclosing on the collateral, a troubled debt restructuring or placement of the loan in an asset held for sale category or the bulk sale of assets to the secondary market. The SAM group has locations throughout the footprint including Charlotte, Philadelphia and Atlanta, which represent approximately 55-60% ofthe total SAM portfolio. The credits were managed by a total of 88FTEs as of November 2005. Internal Audit assessed the risk for this entity as LOW.

CREDIT CAPITAL: Satisfactory

Credit Risk Capital at Wachovia encompasses both wholesale and retail exposures and represented 53% of economic capital in 2005. The calculation and methodology development of credit risk capital resides in the Portfolio Management Group. Credit risk capital represents the loss in value our loans, leases, letters of credit, and other credit instruments could suffer measured at a high confidence interval (99.96%)

Economic Capital for wholesale credit risk capital is calculated using KMV's portfolio manager. It is based on specific assets in the portfolio. The drivers of wholesale credit risk capital are: Expected Default Frequency (EDF), LGD, term, size and industry. These inputs drive economic capital allocation through CPMI and COMP AS to the business units that hold and manage the exposures.

Economic Capital for retail credit risk is also calculated using KMV's portfolio manager. This capital amount is based upon specific product and risk combinations. The input parameters for consumer credit risk capital are developed by the STAR (Structured Transaction and Analysis Group) in partnership with the lines of business. Products include: Prime Equity Lines, Home Equity Loans, Auto Loans, Student Loans, Other Secured, Unsecured and Mortgages. Risk characteristics applicable to most consumer loans are Loan to Value, FICO score, and origination channel. The PMG calculates credit capital factors at granular levels and then rolls them up to product levels which are provided to COMPAS. Capital for retail exposures is not calculated on the individual instruments but on clusters that share similar product and risk characteristics. It is currently not as advanced as commercial credit risk capital given the lack of data on individual consumers.

Planned 2007 credit capital updates are limited to BASEL-related process changes. Except where BASEL II work results in process changes by October 2006, Wachovia does not plan to change from the risk models and EC

CONFIDENTIAL FCIC-134485 Restricted - F.R. methodologies applied for 2006 economic capital calculation.

Current stress testing practices are not applied systematically to assess capital adequacy. Consumer Credit Risk Management prepares various types of stress test analyses, both on an individual product basis and at a total portfolio level. These analyses are intended to predict the potential impact from a series of stressed macroeconomic variables on key parameters of credit risk. Through the use of regression analysis, new stressed parameters would be used to re calculate capital adequacy.

Similar to consumer, stressing the commercial portfolio is performed to understand how an increase in PDs flows through to regulatory capital adequacy. For commercial credit, the current portfolio would be redistributed based on a migration matrix that captures the deterioration of the portfolio. The new stressed portfolio would then be run through the model to determine the impact on capital adequacy.

Economic Capital is highly integrated into Wachovia's credit process. As mentioned in the Limits section, capital guidelines are set for any borrower/relationship by credit grade by LOB.

THIRD PARTY TOOLS & SERVICES: Satisfactory

While there are some third-party tools and services that we know about, this area presents a gap in our knowledge in terms of the full range used for Credit Risk. We will develop an inventory of third party tools and services that are used by Wachovia. One of the most widely used tools, however, is KMV Moody's. This is used to help monitor the commercial portfolio. It is also used, as mentioned above, in the calculation of economic capital.

Recently, Wachovia management chose SunGard's Adaptiv system to use for eounterparty exposure. They also chose Revelus to provide a complete, pre-packaged solution to compute BASEL regulatory capital. There are also situations where Wachovia uses consultants to help with specific projects where they need outside expertise. An example ofthis was the use of consultants (Ernst & Young) to help them with scorecard development.

(See additional information under MODEL REVIEW AND VALIDATION section which discusses how model review will validate products from third parties).

INTERNAL CONTROLS AND AUDITS: Satisfactory

CREDIT ADMINISTRATION: Satisfactory

Servicing and monitoring procedures are usually appropriate. On the corporate side, servicing guidelines are developed in conjunction with risk management with servicing interval and content specified by type and size of credit. These guidelines are documented as policy in the Risk Policy Online. Untimely servicing events are tracked and reported to senior management. The OCC has usually found servicing processes acceptable, although they have noted that there are sometimes issues with servicing backlogs. Management has several efficiency initiatives that are changing servicing intervals based on risk, such as the use of Portal in CIB.

(See ONGOING CREDIT ANALYSIS section above.)

On the retail side, the Asset Quality Monitoring report provides a good overview and LOB and risk managers have satisfactory MIS to manage the risk. (See ONGOING CREDIT ANALYSIS section above.) Collection efforts on problem credits are administered through two business units, one for CIB called Special Situations Group (SSG) and one for GBG called Special Assets Management (SAM).

(See detailed discussion about these groups in the section PROBLEM LOAN MANAGEMENT.)

LOAN SECURITY INTEREST & COLLATERAL MANAGEMENT: Satisfactory

Wachovia's portfolio is highly collateralized, with 78% ofthe commercial loan portfolio secured by collateral and 98% of the consumer loan portfolio secured by collateral or guaranteed. As discussed above, commercial servicing 41

CONFIDENTIAL FCIC-134486 Restricted - F.R. interval and content is specified by size and type of credit.

Wachovia has policy re real estate appraisals to provide guidelines and procedures for obtaining appraisals, ensuring the quality of appraisal content, reviewing and monitoring collateral values, and ensuring compliance with Wachovia standards and federal laws. Appraisals must be ordered through Real Estate Valuation Services (REVS). The Risk/Credit Officer receives appraisal quotes from REVS that will list the cost and timing of the assignment, but appraiser names will not be supplied. The selection of the appraiser is based solely on the cost and timing to ensure appraisal independence. Once a bid is selected, the Risk/Credit Officer will be informed of the appraiser's name.

LOAN REVIEW / CREDIT AUDIT: Satisfactory

Credit Risk Review's (CRR) mission is to independently monitor the bank's commercial and consumer credit exposure by performing ongoing reviews of credit underwriting and servicing practices. CRR also evaluates portfolio quality and risk management practices while providing guidance and risk-related support services to stakeholders. CRR's review efforts provide the opportunity for timely identification of systemic credit process weaknesses and prompt resolution. This proactive approach allows CRR to detect changes in the amount and types of credit risk being taken.

CRR's has direct reporting responsibility to the Board of Directors' Risk Committee, but administratively is part ofthe Credit Risk Management organization. CRR's organizational position within CRM needs to be re-evaluated as a result of BASEL II (i.e., independence).

CRR is made up of Commercial and Consumer teams staffed by 47 commercial and 8 consumer professionals. Commercial reviewers are primarily located in Charlotte, with additional reviewers located in Jacksonville and Philadelphia. All consumer reviewers are based in Charlotte. Each team has its own specific function and area of expertise to ensure adequate coverage of the bank's credit portfolio.

CRR recently completed an overall review of their role and responsibilities and adopted, and is in the process of implementing the following initiatives: 1. Enhance the review selection process to focus on higher credit risk versus portfolio percentage coverage 2. Shift accountability for criticized grades and charge-offs (accuracy & timeliness) to appropriate areas outside of CRR 3. Modify Commercial Credit Risk Review organization structure to align with the business organization 4. Determine CRR process changes resulting from BASEL 5. Eliminate tasks and responsibilities not in line with mission statement 6. Re-evaluate CRR reporting to ensure value-added information 7. Improve coordination with audit 8. Reengineer CRR database to improve efficiencies 9. Determine CRR 'review" boundaries (e.g., structured products with Audit & Operational risk)

Wachovia's Internal Audit conducts a review ofCRR annually given CRR's critical role within Wachovia's credit risk management structure. The last internal Audit review of this area was July 2005 and assessed the overall inherent risk ranking of CRR as Medium. There were no key issues or matters requiring attention.

To date, no formal OCC assessment of Credit Risk Review practices has been made, although the OCC's past four credit reviews of the General Bank (7/00, 9/02, 7/03, and 9/05) found no issues with the manner in which local CRR units supervised their portfolios or any material risk rating issues.

Internal Audit also plays an important role in the management of credit risk. The OCC performed an Audit Unit Assessment in May 2005 to determine the degree of reliance the OCC could place on the audit unit's effectiveness. They evaluated 1) the wlit's planning/testing and monitoring of risk 2) their ability to affect change in the business unit and 3) the adequacy of reporting to management and 4) the quality and level of audit staff. The overall conclusion was that the Consumer and Commercial Credit audit is Satisfactory. The degree of reliance that the OCC can place on the work performed by the audit unit was rated Moderate. The assessment ofthe ability of Audit to affect change in the business unit concluded that audit was getting good corrective action and follow-up to affect change and follow-up audits were effective in confirming new controls.

CONFIDENTIAL FCIC-134487 Restricted - F.R. Audit leadership has continued to make measurable progress in strengthening the audit function. The OCC concluded in their exam that Audit Committee oversight was appropriate; management, reporting and staffing are satisfactory; and audit process issues have been sufficiently addressed. Significant improvements were noted in Audit's stature and staffing expertise

MODEL REVIEW AND VALIDATION: Fair

Internal audit report of corporate model govemance dated September 7,2005 has issued a "Needs Improvement" rating to Wachovia's corporate model governance. As positive developments, the report cited the implementation ofa corporate model risk policy, the establishment of an inventory of all models, the independent validation process for all material models and a mandatory annual review of material models by the model risk committee (MRC).

The issues identified in the report were related to the roles and responsibilities of the MRC. Specifically, report recommended that specific accountabilities be outlined for the MRC chairperson, as well as that accountability be clearly assigned for managing the validation process and the corporate model inventory. Audit also recommended that management develop and execute a formal communication process to emphasize the importance of model risk management, provide information about the model risk management structure, and each person's role and responsibilities in the process of model risk management.

In its response to the findings management cited the recent hiring of a new Head of Market Risk Management who is designated as the chairperson of the MRC with the responsibility of reviewing model policies, processes and structure. Based upon his review and Audit's recommendations, appropriate changes in the govemance structure for material models and for thc model process ovcrall, including roles and responsibilities, was to havc bccn implcmcntcd and communicated by March 31, 2006.

As matters requiring attention, the report recommended that the MRC revise the model risk policy to include requirements for validating inputs for models, change control procedures, and back testing procedures.

The new Model Validation Policy and the Model Risk Policy were approved in March 2006. They define material models and mandate that business units that own them must follow the policies and are responsible for security measures, change control, back testing, and disaster recovery. According to the policies, MRC reviews and approves the material model list, the model risk report, and the annual model inventory review. Market Risk Management's Model Validation and Approval Group (MVA) approves all material models, and is responsible for validation and annual revicw of all models dcvclopcd by CIB and all models uscd to dcterminc rcgulatory capital under Bascl II. Credit risk review independently reviews the process for all models impacting credit risk capital, including development and validation.

LOAN LOSS RESERVE PROCESS: Satisfactory

The Corporate Loan Loss Allowance Committee, chaired by the Chief Risk Officer, meets quarterly and is responsible for review and approval ofthe allowance for credit losses as well as for policies and procedures connected with its determination. The Risk Committee of the Board of Directors reviews and approves policies governing the determination of the allowance for credit losses.

While Wachovia' s ALL as a perccntagc of loans is lower than its pcers, its loss history supports its adcquacy. ALL as a percentage of charge-offs compares favorably to its peers, admittedly aided by its previous absence from a credit card issuer role. The adequacy of the ALL can be seen below:

3/3l/0S 6/30/05 09/30/05 ·12/31105 .3t31/06 ALL/Loans 1.20% 1.18% 1.13% 1.05% 1.08% ALLlNonperforming Loans 300% 332% 347% 439% 452% ALLlNet Charge-offs l4.79X l3.47X 11.38X 13.37X l2.92X

Wachovia's model for the allowance for loan losses has four components: formula-based components for both the 1) commcrcial and 2) consumcr portfolios, each including an adjustmcnt for historical loss variability; 3) a reservc for impaired commercial loans; and 4) an unallocated component.

CONFIDENTIAL FCIC-134488 Restricted - F.R.

For commercial loans, the formula-based component of the allowance for loan losses is based on statistical estimates of the average losses observed for commercial loans classified by credit grade. Average losses for each credit grade are computed using the annualized historical rate at which loans in each credit grade have defaulted (Default rates) and the historical average losses realized for defaulted loans or LGD. They have developed default rates by analyzing seven years of default experience and over 20 years of comparable external data. Default rates, which are validated annually, are estimates derived from long-term averages and are not conditioned on short-term economic or environmental factors. LGD rates have also been developed using seven years of internal and industry data.

For consumer loans, the formula-based component ofthe allowance for loan losses is based on loss rates for specific groups of similar loans in each product category. The loss rates are based on historical loss data, historical delinquency pattcrns, vintagc analyscs, crcdit scorc-bascd forccasting mcthods and strcss tcsts.

For commercial and consumer loans, the formula-based loss components include additional amounts to establish reasonable ranges that consider observed historical variability in losses. Factors they may consider in setting these amounts include, but are not limited to, industry-specifIc data, portfolio-specifIc risks or concentrations, and macroeconomic conditions.

Wachovia has established a specific reserve within the allowance for loan losses for impaired loans (commercial loans on non-accrual status). They individually review any impaired loans with a minimum total exposure of$10 million in the Corporate and Investment Bank and $5 million in other segments and reserve for each based on the difference between the loan's carrying amount and the loan's estimated fair value. No other reserve is provided on impaired loans that arc individually rcvicwcd.

The allowance for loan losses is supplemented with an unallocated component, reflecting in part the inherent uncertainty of estimates and is designed as a final tool in fully capturing probable incurred losses in the loan portfolio. The amount of this component and its relationship to the total allowance for loan losses may change from one period to another. Wachovia anticipated that the unallocated component of the allowance will generally not exceed 5 percent of the total allowance for loan losses.

In June 2004, Wachovia reclassified the reserve for unfunded lending commitments that relates only to commercial business from the allowance for loan losses to other liabilities.

Wachovia's Internal Audit team in September 2005 evaluated the design and tested the operating effectives of internal controls for the calculation, allocation and governance of the Allowance for Credit Losses. They concluded that the overall control environment was adequately designed and operating in an effective manner. Review work performed by CRR confirmed the adequacy ofthe Allowance.

CONFIDENTIAL FCIC-134489 Restricted - F.R.

Market Risk

Inherent Risk

Inherent Market Risk

Inherent Trading Book Market Risk: Moderate Risk

The level of inherent market risk for the trading book is moderate. The moderate rating blends the limited exposure shown in traditional measures such as Value-at-Risk and desk level Greeks, DVOI and notionals, and the consideration ofthe types of markets in which Wachovia's Corporate Investment Bank (CIE) trades. CIE receives a high percentage of its income from its activity in less liquid markets, such as structured and credit products. Wachovia is generally only a customer flow trader, with small proprietary positions taken while trading the bid-ask spread of customer flows. However, these proprietary positions are governed by VaR, notional, Greek, and/or DVOllimits for trading desks. Proprietary books (convertibles, credit products, short-dated options, and liquid equity products) are small and closely monitored.

The volume and trading exposures have increased in the past year, but 2005 Average VaR & Limit Wachovia does not maintain the same level of market exposures of other LFls. Based upon measurements of 35 risk such as VaR stress tests and ----+--97% limit utilizations, market exposures 30 .. * * * * * * * * * * .. are well below peer LFIs. The 99% ovcrall VaR limit is $30 million (for 25 97.5% CI, I-day HP); Wachovia -Limit trading desks averaged $18 to $22 20 million, or 60% to 70% ofthe VaR limit during 2005. The VaR limit 15 represents only 3% of the 2005 trading related revenue. 10+--,--,--,--,--,,--,--,--,--,--,--,--,

The level of inherent market risk remains stable. Trading activity shows revenue growing without associated increases in market risk metrics. Management has moved to improve the trading infrastructure to support expansion, but it remains a work in progress.

CONFIDENTIAL FCIC-134490 Restricted - F.R.

Market Environment:

During 2005, the yield curve continued to compress as the FOMC increased short rates, and yields across the curve rallied. Institutional investors expect domestic economic activity to trend lower as other major central banks follow U.S. monetary policy in raising rates and reducing liquidity; however indicators ofliquidity such as broad monetary aggregates, credit spreads, and borrowings have not been significantly impacted. At this point in the interest rate cycle, bond markets are experiencing some negative returns from rising yields due to economic growth, increasing global capacity utilization, and large price increases in the commodity markets, especially oil, raw materials and metals. Equity prices have moved higher as well on global economic profits. These market factors will impact the carry in the fixed income portfolio, the performance ofWachovia's new commodity activities in gas, oil and natural gas, and their equity trading returns.

Size of Positions: Moderate Risk

Inherent risk from the size of positions is moderate relative to capital and earnings. This assessment takes into account the limited risk as measured by VaR and non-VaR risk measures, as well as the relative size and variety of the positions in more complex activities within CIB, in particular the structured products area. In addition, the assessment considers management's continuing expansion plans for the size and components of its trading activity.

Total revenue from trading in 2005 was roughly 2% of total shareholder equity. Most of the trading revenue is generated from customer flow business of various traded products. Interest rate, structured and equity products have the largest VaR exposures. However, open positions are managed within reasonable VaR levels. Usage levels for VaR during 2005 were from 50% to 75% of VaR limits. The VaR methodology for trading is generated using a 97.5% confidence with a one day holding period.

Global rates products such as derivative interest rate products, foreign exchange and municipal products combine to make the largest traded positions with the greatest turnover. Market risk, based upon VaR usage levels, was relatively moderate at 50% to 70% for interest rate products, and 10% to 20% for FX. During 2005, the yield curve was relatively flat, with yield volatility below historical averages. This led to less customer activity and lower trading revenue than projected for this business line.

Structured products represent Wachmiacm VaR the second largest group of traded financial vehicles. Structured products include 120 CMBS, asset-backed securities 100 and CDOs. The inventory level VI -- 80 of structured products is --'" reasonable at 25% to 30% of all ...=Q 60 products traded. However, - 40 ==~ customer demand and 20 I r profitability of structured 0 r- III I I I I r I I I I r I products led to steady growth in 2005. VaR levels for structured products rose substantially with the down grades of debt in the automotive sector last year. D 1-DAYVAR 1II10-DAYVAR VaR limits were breached several times in 2005. Outside of those instances, VaR usage levels for structured products have remained at approximately 50% to 70% in 2006.

Positions in credit products consist of investment grade debt, high yield bonds, loan trading and credit portfolio management. VaR levels for credit products were moderate to low in 2005. Following the extraordinary widening in

CONFIDENTIAL FCIC-134491 Restricted - F.R. spreads in 2005 and losses from long positions in the automotive industry, risk positions were reduced in corporate debt and CDS trading. Risk exposures have remained moderate in 2006 as trading management seeks to trade more issuers and expand their high yield origination business.

Equity positions were reduced in 2005 following losses from trading in convertible arbitrage and structured equity products. Risk exposure was reduced, and trading management brought in a new team of traders for structured equity and derivatives products. VaR measures for equities declined throughout 2005. In 2006, VaR levels have declined further, though expansion plans in this area are likely to reverse this trend.

In addition to the daily VaR and stress tests using multi -standard deviation shifts in yield curves, swap spreads, and volatilities, Market Risk Management has developed stress tests from "market disasters". The market disasters represent four key historical scenarios in financial markets using movements in yield curves, equity markets and volatilities driving price and yield. The market disasters are the 1987 equity markets crash, the 1994 bond market sell off due to FOMC policy changes, the 1998 credit spread widening from the Russian debt defaultlLTCM bailout, and the flight to quality during the 9/11 terrorists attacks. Of the market disaster scenarios, the 1994 run-up in market yields negatively impacts the interest rate products sector with the greatest potential for loss. However, another scenario which Market Risk Management performs and analyzes is a combination of the 1994 bond market sell-off and 1998 credit spread widening. In this scenario where rates rise dramatically, and spreads widen as well, the positions in the trading books as of 03/31/06 suffer extraordinary losses ranging from $600-$800 million.

The analysis from a scenario where rates rise and credit spreads widen could become critical with fixed income markets vulnerable to dislocation. Currently market yields are low versus history. Also the U.S. Treasury yield curve is relatively flat and likely to steepen following the end of the monetary policy cycle. Credit spreads remain tight as well, and at levels consistent with above trend GDP growth. Finally, historical yield volatility at the short and long end of the U.S. Treasury curve declined from mid-year 2000 to 2003. In 2004, both short and long duration yield volatility began to rise in earnest, with short duration moving at a faster rate. Currently, yield volatility for short duration governments is just above long term averages. Long duration yield volatilities are below long term trends. The combination of inflationary pressures above expectations, and the continuation of tighter monetary policy could create higher short and long term interest rates. This scenario would lead to higher volatility, wider credit spreads, and steeper yield curves.

Liquidity and Complexity of Positions: Moderate Risk

Inherent risk for the composition of liquid and complex positions is moderate. Wachovia trades in a variety of instruments and markets. These instruments range from the vanilla derivatives found in interest rate products such as swaps and FX, to more complex/exotic instruments found in structured and credit products. The structured and credit products are not only complex, but are also some of the more illiquid products traded by the bank. Wachovia has experienced consistently positive trading revenue and has not experienced any recent liquidity issues.

• Products that are less liquid and complex include 3rd party loan products which are securitized, structured products, correlation trading, private equity investments, and high yield bonds. • Products that are also considered complex but not as illiquid include mortgage options, total return swaps, equity derivatives and equity linked products (i.e. variance swaps, basket swaps).

Of these products, structured products are the largest in tenns of volume and revenue attribution. A majority of the trade-related revenues are now derived from the structured products LOB, 56% (excluding private equity). Products within the Structured Products LOB include the securitization of 3rd party assets specifically CMBS, CREF, ABS, consumer loans, and middle-market loans, as well as traditional CDO structures, synthetic CDOs, and correlation trading.

Some of the risks include warehousing ofloans waiting to go to market, complexity of synthetic structures, market execution, pricing, and hedging. Growth of structured products continues as Wachovia increases deal volume, increases the size of market deals, expands into new markets (Europe and Asia), and develops new products and asset classes. Risk is somewhat mitigated due to the strong market for these deals and the historical success ofWachovia in 47

CONFIDENTIAL FCIC-134492 Structured Products Division 2005 Revenue Mix Among Products Restricted - F.R. bringing these deals to market. In addition, one of the largest warehouses, CMBS, is hedged for both interest rate and credit spread risk.

The vast majority ofthe financial products traded are liquid with pricing models in place to value changes in market factors. These interest rate products include: U.S. Treasuries, government agency debt, municipal bonds, investment grade debt and interest rate swaps. Some products such as asset-backed REInv. securities, collateralized debt obligations, and option products, such as cliquets, can only be priced using internally developed proprietary models. Residuals or first loss pieces of structures that are retained by Wachovia, as well as any consumer deals Asset Mgt & ABS Senidng (prepayment risk) or hard to price asset classes, are valued independently by a separate quantitative group, STAR. Models used by STAR are also internally developed.

Note: Stmctured Products represent $1.6B of$2.7B (excl. Private Equity) or 56% of revenues. Product mix is well diversified.

More conservative VaR and desk limits help control exposure. Market Risk Management monitors risk through stress scenarios that include spread widening, volatility changes and major market disruptions. Finance controls the month end MTM pricing for trading instruments. Products without vendor pricing approximates 20-24% per month for the Fixed Income Division. Management reviews this ratio in conjunction with aged inventories. Particular attention is given to aged inventory greater than 100 days. This is mainly attributable to structured product warehouses as more deals are being completed and deals in the market are larger ($2-2.5B). Trading management is held accountable for long standing position and reserves are maintained as a result. Other types of reserves are held for credit, bid/ask spread, and operational aspects for the Fixed Income Division.

Overall trading volumes have increased modestly in the past year, while individual product volumes have varied. Equity origination, equity structured products and equity finance grew by 72%, 28% and 14% respectively from 4Q04 to 4Q05. But during this same period, equity proprietary trading, and equity sales and trading declined by 50% and 17% respectively. The increase in equity origination and structured products revenue, along with the reduction in equity proprietary trading was part of the change in Equity Trading Management and business strategy.

In 2005, fixed income volume grew modestly from 2004 by 10%. Fixed income revenues grew above budget by 14%. Real Estate Capital Market assets increased 73%, with a 50% increase in revenue from 2004, and 31 % above 2005 budget. Residential Mortgage Assets and Structured Credit Products positions grew 27% and 12% respectively. The overall revenues associated with residential and structured credit products jumped 58%, and were 80% above budget. With the decline in yield volatility and higher borrowing costs, positioning of derivative products fell 16% from 4Q04 to 4Q05. During the same period, leveraged finance positions declined by 16% as well.

Private Equit/:

At year-end 2005, equity investments within CIB totaled $1.7 billion or 1% oftotal securities and trading account

1 While private equity is not a "traded-risk" it does have valuation exposure that flows through the crn and Corporate income and is therefore addressed in the market risk section. 48

CONFIDENTIAL FCIC-134493 Restricted - F.R. assets. The majority of equity investing takes place within Wachovia's private equity investing ann, Wachovia Capital Partners (WCP), with limited relationship investing taking place within Structured Products ($78 million) and Real Estate Capital Markets ($31 million). WCP's total portfolio of $1.6 billion is split relatively evenly between fund and direct investments, totaling $841 million and $753 million, respectively.

WCP's direct investment portfolio is well diversified between five verticals including Energy (6.9%), Financial Services (30.3%), Growth Industrial & Business Services (21.8%), Healthcare (13.0%), and Media & Communications (27.9%). Although the direct portfolio is well diversified among industry sectors, it is highly concentrated in the domestic economy providing a minimal geographic diversification benefit. Additionally, WCP's top 10 largest investments accounted for 28.6% of the entire WCP portfolio as of February 28,2006, a large exposure relative to the total private equity portfolio but a minimal 0.3% oftotal securities and trading account assets.

A rejuvenated private equity environment resulting in increased EBITDA multiples and significant fund distributions resulted in a strong 2005 for WCP from a revenue perspective. Specifically, total revenue increased 53.6% year-over year to $401 million and accounted for 3% of total non-interest income. While 2005 was a solid year, management is projecting a slightly slower 2006. The total revenue goal for 2006 is $302.5 million. WCP exited deals in 2005 that originated in 1997 and 1998 and is now looking for exit opportunities from the leaner portfolio years of 2000 and 2001. In fact, management is expecting 2000 to be the only negative IRR vintage. On a positive note, the company thinks the IPO market and strategic sales will heat up in 2006.

WCP is in the process of closing a fund sale. Approximately 26 funds with a book value of $306 million and aNAV of $436 million as of February 28,2006 were transferred to a SPY. The transaction will involve the sale of a 20% interest in the Spy at 110% ofNAY. The sale is estimated to generate $25 million in cash gains, plus a write-up of $100 million for the remaining 80% ownership. WCP plans to progress from the funds sale to raise a "fund of funds" and then potentially raise a fund of direct investments once it has established itself in the marketplace. Wachovia is currently offering a competitor's product to CMG and WMG clients, but hopes to eventually be able to offer its own product to these customers.

Strategy and Business Mix: Moderate Risk

The inherent market risk from the strategy and business mix is moderate. The risk positioning philosophy of the Corporate Investment Bank ofWachovia is to derive the majority oftrading income from customer-initiated trades. The trading income includes customer flow business using fixed income instruments, structured products, derivatives, tax-exempt products, commodity products and FX. While customer flow business is lower risk than proprietary trading, the strategy of customer accommodation is reactive to customer requests, which is additive to strategic risk. Proprietary trading is not significant and revenue is generated mainly through capturing the bid/ask spread on customer transactions. Refer to the Stability of Earnings and Perfonnance History Section below for a more detailed discussion of proprietary trading levels and products.

Functional trading desks consist of Global Rate Products, Credit Products, Structured Products and Equities. Wachovia acts as market maker as well as agent in all the traded products noted above. Niche markets where the bank has comparative advantages include: • Structured Products. Wachovia is a significant market leader for securitization of3rd party assets, particularly ofCMBS, CREF, ABS, and consumer loans, as well as traditional and synthetic Collateralized Debt Obligations (CDOs). Wachovia's expertise and market presence has continued to grow over the past few years. In 2005 structured products represented half of trading revenues (excluding Private Equity book). Management will continue to focus on this Line of Business (LOB) and is just starting to expand to Europe and Asia. Growth in this business has also increased risk associated with warehousing loans until the structure is brought to market. Warehouse loan levels have trended higher, in-line with larger deals being introduced in the marketplace. Management is concerned about this risk and actively monitors the warehouse levels, aging of assets, and asset turnover ratios. The CMBS warehouse, one of the largest, is hedged for both interest rate and credit spread risk. • Global Rate Products. Wachovia is a significant originator of standardized interest rate products, but Wachovia is also a significant player in the municipal market. Municipal activity is focused on origination 49

CONFIDENTIAL FCIC-134494 Restricted - F.R. and undenvriting, as well as Tender Offered Bond (TOB) undenvriting. Additionally, Wachovia is one of a few players of mortgage options (within the Options < 1 year book). For 2005, revenue contribution was minimal and was negatively impacted by the market environment and resulting customer preference for this product.

New customer fixed income business strategies for 2006 include: • Establish customer flow business for fixed income clients trading via CSAs • Increase Volumes on Derivatives Desks • Building a relevant Public Finance/Origination Platform • Build a Marketing Team and Infrastmcture for Commodity Trading • Develop substantial FX Options and Global Institutional FX Businesses • Leverage U.S. distribution of Global Stmctured Rates and Correlation Credit • Expand Global Stmctured Rates and Correlation Credit to Europe and Asia

New product strategies: • Create "Rent-A-Swap" business for Small Banks and Middle Market Finance Companies • Add Constant Maturity Mortgage products to Institutional Sales and Trading • Create 3n1 Party Stmctured Products Business • Develop Stmctured Products for institutional and retail clients

The Equity LOB was reorganized in early 2005 and new management was hired to grow the equity business. The Equity and Equity-Linked Products lines were integrated to provide a singularly focused business unit to leverage resources. Also, the capabilities to provide equity stmctured products to meet customer needs were added. Historically, the Equity business has not been a focus of growth and more as a necessary product line to be a full service trading shop to its existing customer base. However, with the reorganization and additions to staff, the Equity Division has developed a strategy which will take advantage of the balance sheet size and reputation gained in fixed income markets. Management hopes to move into the top 10 amongst bookmnners on Wall Street. The new customer equity business strategies for 2006 are: • Leverage the "Universal Banking" platform to increase revenue and market share • Create an Equity Origination platform ranking in the Top 10 on Wall St. • Expand Sales & Trading to maximize fees and proprietary trading where Wachovia has competitive advantages • Engage in proprietary trading to earn attractive risk-adjusted returns • Acquire equity professionals, products and technologies that enhance Wachovia's competitive position

New trading strategies are limited, but management will create new products that compliment existing LOB product lines. New products are generally developed in response to Wachovia's existing customer needs and where they can leveragc off cxisting markct niches. Developmcnt from traditional CDO products to customcr-tailorcd single tranchc CDOs is one example. Furthermore, CIB has an established, albeit evolving, new products process in place. Referto the New Product Approval Section for more details on this process.

Components of Price Risk: Moderate Risk

There is moderate price risk to fixed income portfolios and currency positions from changes in the relative steepness of yield curves and FX rates. From stress tests and scenario analysis conducted by Market Risk Management Data Analysis, fixed income positions show limited-to-moderate exposure to twists and shifts to U.S. Treasury and swaps curves. Extreme movements in swap spreads and the U.S. Dollar create moderate to considerable exposure for fixed income and currency positions. However, these tests assume no active risk management of the positions would occur to mitigate exposures in sudden changes in rates and volatility.

The trading book has a fair amount of options risk. The equities book contains the most option risk, followed by the short-dated options book.

CONFIDENTIAL FCIC-134495 Restricted - F.R. • Equity Linked Products contain a significant amount of optionality but management has been working to reduce risk during the past year. • Wachovia is heavily involved in offering interest rate options and swaps to its customers. The short-dated options book is primarily mortgage options, options on treasury bonds, short-dated swaptions and Eurodollar options. Most ofthe risk taken results from taking positions in different products at different strike prices. These are not outright naked option positions, as the business line actively monitors and hedges these positions. Nevertheless, this business experienced volatility over the past year.

Other products within Global Rates that contain option risk include structured products, oil and gas commodity derivatives, and a few interest rate products. Structured products contain a significant amount of optionality, particularly in the single tranche synthetic CDO business. The convexity on these products is difficult to hedge and the model currently used is not as tested as models in more mature products. Management is now keeping the book matched by tranche level. The level of option risk pertaining to the oil and gas commodity derivative business is currently small as volume of positions is low. This business was started late 2004 and slow growth is expected. Wachovia has little exposure to Bermuda barrier options and a moderate amount of exposure to Bermuda options. However, many ofthese are mirror-hedged. Further, management has begun to ramp up the use of callable range accrual business but current positions are small. Option risk wil1likely increase in the future as a structured products manager was recently hired to design products with imbedded options, particularly for interest rate products, FX, commodities, and credit product LOBs. The driving force behind the development ofthese new products is to reduce customer costs and achieve specific risk profiles for the customer.

The level of basis risk is considered moderate. Wachovia makes markets in LIB OR-based products, as well as non LIBOR indices such as prime, FF, CP, and BMA. Risk of spread widening is Wachovia's most significant risk. The correlation trading book has the most significant basis risk due to the synthetic single tranche CDO structures associated with this book. Basis risk is also prevalent within interest rate products division, specifically the mortgage option and municipal products. Mortgages options are typically hedges with treasury and other interest rate options. Stress scenarios are completed separately for mortgage volatility as well as basis risk. Other examples of basis risk embedded in the trading book include Corporates & ABS products that are hedged with Libor-based products, mortgage products where the underlying and the hedge are different agencies, equities that are hedged with equity indexes, and TRS on different CMBS indices.

Model risk is an issue now at the forefront with price risk for Wachovia. The expansion into structured products in recent years has required the development of financial products where price changes are based upon internally developed models. Products such as, CDOs and credit derivatives do not have enough historical data in extreme stresses under entire interest rate or credit cycles. Therefore, current assumptions may not reflect actual market responses or prices if such stress events were to occur.

Stability of Earnings and Performance History: Moderate Risk

Trading revenues are relatively diversified Trading Related Revenues ($MM) among various product lines, attributing to a (Trading, Fee & Other, Net Interest) reasonable level of earnings stability. 2005 3000 trading-related revenues were $2.7B (excluding o Equities loan portfolio within Credit Products LOB). 2000 This represents an increase of 20% year-over o Structured Products year. Although Wachovia's performance is 1000 • Credit Products (less noteworthy, it does not match other large loan portfolio) financial institutions' trading shops who take on • Global Rates significantly more risk. Daily trading o 2003 2004 2005 performance has generally been positive with Note: Two credit-related groups were combined in early 2004 representing most few daily losses. The top daily loss during 2005 of the increase between 2003 and 2004 was $16MM (short-dated mortgage option desk hurt by front-end curve rally and short dated volatility that day). 51

CONFIDENTIAL FCIC-134496 Restricted - F.R. Trading desks providing significant revenues were Structured Products, followed by Global Rate Products. However, trading losses in the fourth quarter offset the good performance overall. Trading profits declined $193 million from the third quarter to the fourth quarter. Credit spread widening on long positions in Investment Grade, CMBS and CDS, and repositioning of synthetic CDO structures led to the losses. Management has taken appropriate measures to limit future losses and replaced the trading staff with more experienced traders. Net interest income from trading activity declined $48 million, or 4.3% from 4Q04 to 4Q05. This decline was due to the reduction in mortgage trading positions.

U sing the coefficient of variation (CV =standard deviation/mean; measure of dispersion of a distribution) over a two year horizon with quarterly sampling, there is a mixed picture of revenue stability. CIB shows stability in the top-of the-house measures of net income, revenue, and revenue contribution to the corporation, with CVs of 12%, 11 %, and 6%, respectively. When looking solely at trading account income from regulatory reports, the CV shows a much wider dispersion at 158%. Given the business mix orientation toward customer flow, these results are to be expected.

Wachovia's Private Equity division's performance is tracked separately from the above mentioned trading revenues (graph). Principal Investing is a more volatile activity, given the nature of these investments. An improving economy and moderate impairments returned this group to profitability for the past two years and is expected to continue. 2005 revenues were $401MM; 2004 revenues, $206MM; and 2003 losses, $149MM. Refer to the Liquidity and Complexity of Positions Section for further details.

The majority of trading income is derived from customer 2005 Trading-Related Revenue initiated trades. Wachovia has a minimal level of Breakdown proprietary trading. Proprietary trading is generally off of existing customer positions and is not captured separately from general trading revenues. Trade-related revenues, as Net Trading shown on the graph, account for 7.6% of total 2005 trading revenues, but proprietary trading is small portion of this category. Books that do have a higher level of proprietary trading include: o Equity Linked Products - convertible bond book. o Short-dated Option Desk - may take a limited view from customer flow and knowledge of the market. o Equity Liquid Products. o Credit Products - prop credit trading. Note: Trading revenues mainly represents trade-related revenues and to a lesser extent, proprietary trading revenues. Diversification: Moderate Risk

Inherent market risk from diversification across products, customer base and geography is moderate. In 2006, Wachovia's risk, as measured by VaR, has shown a movement from being concentrated in fixed income activities, to a more even spread between debt and equity activities. As of June 19,2006, fixed income contributed $11 million in VaR, while equity contributed $14 million. While these numbers tend to move, in general they are representative of the current trend of fairly equivalent VaR in the two main asset classes. On the revenue side, there isn't the same balance. In 2005, CIB fixed income revenues were over nine times those ofthe equity division. 2006 appears to be a continuation of the trend as equity activity is still being restrained while infrastructure is being built. Within fixed income, activities are fairly well diversified. The combination of risk diversification and revenue reliance, along with the diversification within fixed income activities, leads to modest key dependencies and an overall "moderate" risk rating.

Wachovia has expanded the trading revenue base with desks covering Global Rate Products, Investment Grade Debt, High Yield Debt, Commercial Real Estate Finance, Structured Products and Equities. In 2005, 40% oftrading related revenues came from Global Rate Products, and approximately the same contribution in 2004. In 2005 Commercial Real Estate Finance and Structured Products trading revenues grew by 85% and 32% to $198 million and $231 million 52

CONFIDENTIAL FCIC-134497 Restricted - F.R. respectively. However, trading related revenues were down substantial in Equities, Investment Grade Debt and High Yield Debt by -34%, -142% and -130% respectively.

For 2006, investment banking management is projecting an increase in investment banking revenue of2l % to $4.032 billion. Trading and institutional derivative marketing is expected to increase by 243% or $425 million to $600 million. Total revenues from Leveraged Finance and Investment Grade Debt are projected to grow 68% and 43% to $367 million and $252 million respectively. These projections are based upon a new emphasis on increased business with existing client base in Global Rate Products, and expansion into European (London) and Asian (Hong Kong) markets. Other areas which have been significant providers of revenues are forecast for declines in growth due to retrenchment or slowing activity in those markets. Structured Credit Products revenues are projected to decline 31 % while residential mortgage and consumer products revenue should fall 19% according to forecast.

Wachovia offers various trading products in their fixed income, and equity divisions. As of year-end 2005, approximately 85% of the traded products were housed in the fixed income division with the remainder in equities. Of the net fixed income positions at year-end 2005,35% are interest rate derivatives, 20% loans, 20% Real Estate Capital Markets, and 12% Structured Credit Products. The customer base consists of corporate customers hedging financial risks and institutional and retail clients seeking long/short positions in financial products warehoused or brokered by Wachovia. In 2005, key contributors to trading revenue were Fixed Income Structured Products, Global Rate Products, and Equities/M&A providing 47%, 16%, and 13% respectively. For the Fixed Income division structured products remains a modest key revenue dependency, though as noted in the "Liquidity and Complexity" section, there is diversification within the structured products area.

Position in the Market: Moderate Risk

The risk to earnings and capital from \Vachovia's position in markets is moderate. In markets where the bank has a strategic advantage such as loans and assets for CMBS or CDOs, Wachovia is ranked in the top five in league tables. In those markets where traditional investment banks are established, Wachovia is outside the top ten in most categories, yet, Wachovia made progress in rankings in League Tables in 2005, as they moved up in position for several markets. They act as market maker in some products markets and agent in several markets. However, trading activity would not be considered controlling or influencing markets. As of 2005, Wachovia was ranked: • No. 13 Equity New Issue • No.4 Investment Grade Loans • NO.8 High Grade Bonds • NO.6 LeveragedlHigh Yield Loans • No. 11 LeveragedlHigh Yield Bonds • No.5 Global CMBS Bookrunners • No.2 U.S. CDO Bookrunners • No.1 Contributors to CMBS Deals in U.S. • No.2 CDO Bookrunners

CONFIDENTIAL FCIC-134498 Restricted - F.R.

Trading Book Market Risk Management and Controls

Trading book market risk management and controls are satisfactory, based upon results of recent audits, the assessment by the OCC, and a review of available documentation. Risk management is undergoing numerous changes being driven by new leadership in independent Market Risk Management, which has gained improved stature within the organization during the year. Documentation of risk management activities indicates several gaps, which include project management/technology ineffectiveness, inconsistent reporting, and weaknesses in the policies & procedures. Recent meetings with management highlight steps being taken to correct these gaps, though admittedly, this will be a multi-year effort to reach their desired standard. The issues are well-understood by market risk personnel, who have implemented compensating controls such as holding limits constant until the infrastructure foundation is built and close oversight of traders.

CONFIDENTIAL FCIC-134499 Restricted - F.R. Board and Senior Management Oversight

Board Governance, Structure, and Oversight: Satisfactory

The board oversight of trading risk is satisfactory given the extent of activity at Wachovia Corporation. The board of directors receives trading reports, new product documentation around significant new activities, and risk reports. The information received by the board is sufficient for them to understand the risk profile of the organization and trading activities, and to thereby set the risk appetite. The board receives high-level performance and risk metrics. Risk metrics include quarterly average Value-at-Risk (VaR) profiles for the corporation and product groups, disaster scenario results (9/11, 1987 stress, 1994 stress, 1998 stress) and I-day 4-sigma stresses.

The board of directors delegates authority for operational oversight to the Senior Risk Committee and the Asset/Liability Committee. CIB Market Risk Management, a subgroup of CIB Risk Management, also reports through to the Senior Risk Committee.

I Board of Directors I

I Senior Risk Committee I

Corporate Risk AssetlLiability Management Committee

CIB Risk Management CIB Executive Mgmt

Head of Market Risk Investment Global Management Banking Financial Institutions & Trade Services I London I Equities Global Markets Fixed • Treasury I Income Model I Risk Analvtics Services Validation • Equity Division Regulatory Global Capital & • Capital Finance Market Data Research ---1 Backtesting Analysis GCM • CIB Support Support ----1 ---1 Global Rates Traded Credit ---1 Other Support Products I I On Dcmand

CONFIDENTIAL FCIC-134500 Restricted - F.R.

Management Governance. Structure, and Oversight: ~atisjactory

Market risk management is satisfactory. Senior management is adequately informed of the trading book market risk and there are sufficient expertise in place for the current level and complexity of activity. As can be seen in the preceding organizational chart excerpt, market risk management is independent of business line activity, with reporting lines crossing at the Senior Risk Committee level. Importantly, CIB Market Risk Management is only two employees away from completing their staffing initiative that started late last year. These employees start in June 2006.

Market risk management is executed through business lines management, risk partners in Market Risk Management, and through the committee structure in the area. Committees are provided in the following organizational chart.

I Board Credit and Finance I Senior Risk Committee I I I I Market Ops Risk Credit Risk ALCO RiskCrnte Crnte Crnte

I I I I CIB Risk-Return Complex Transactions I I Risk Crnte. CIE Operational CIE CIE Connnitment Crntes: RiskCrntes: Valuation • FID Connn Crnte • Transaction Connnittees: • ELP Connn Crnte Risk Exposure • AHFS • ECM Connn Crnte • New Products Valuation • GCM Connn Crnte • Fairness • CIE Bridge Cornrn Crnte Opinion • em Fund Investing ernte • WCP Principaiinv ernte • Congress FC Sr. Credit

The main committees and oversight for market risk include the Market Risk Committee, CIB Risk-Return Committee, and Market Risk Management.

The Market Risk Committee meets quarterly and is responsible for oversight ofWachovia's market risk associated with trading activities and approval of a variety of trading limits designed to match trading activities to Wachovia's business strategies and risk appetite. The committee reviews aging reports, mark validations of marked-to-model trading positions, monitor the adequacy of market risk management infrastructure, and provide market risk information from the CIB Risk-Return Committee and market risk management.

The CIB Risk-Return meets monthly and is responsible for evaluation and oversight of major risk taking activities across CIB, encompassing market, credit, operating, and reputation risks inherent in CIB' s portfolios, inventory positions, and activities. Committee minutes indicate that discussions are forward looking in nature, witl1 specific

CONFIDENTIAL FCIC-13450 1 Restricted - F.R. consideration given to anticipated business flows, and environmental conditions (e.g. economic, market, competitive, regulatory).

Market Risk Management (MRM) is responsible for ensuring that trading market risk will be measured accurately and Head of Market Risk clearly communicated to senior management so that Management management understands the current risk/return profile of the (Adam Litke) organization and can make informed decisions, in order to avoid losses while encouraging trading in a sensible manner. London (2) Equities (2)

Of the groups listed in market risk management, the Traded Model Risk Analvtics (10) Credit Products, Equities, and Global Rates teams are desk Validation (12) level market risk oversight. On Demand Risk relates to a technology/database/reporting project intended to provide non Regulatory Capital Market Data VaR risk metrics at the desk head level at the end of the day & Backtcsting (5) Analysis (8) rather than T + 1, but won't provide intraday metrics. Model Validation, Market Data Analysis, Risk Analytics, and Global Rates (5) Regulatory Capital & Backtesting are consolidated functions. Traded Credit ----1 London Market Risk Management, which reports on a dotted Products (5) On Demand Risk (l ) line to Adam Litke, is responsible for oversight ofWachovia Securities International, Limited, the London based securities and investment banking broker-dealer.

The addition of Adam Litke to CIB Risk Management was a strong step-forward for Market Risk Management. Mr. Litke has been able to increase his overall level of staffing and to improve the quality of personnel. Mr. Litke seems to bring technical expertise, big-picture understanding, and the ability to convince senior company management of the need to advance risk management. During the past year, market risk management as a function and as a philosophy, has gained higher stature in the organization, improving the control culture in relation to years past.

A recent management change was to combine Corporate & Investment Banking the Global Markets and Steve Cummings Investment Banking

under one manager, Ben :T~Ch;O~gJ: Su;a; Ce;t;m-; - -I Williams. The intent is IOperations - Bob Sontag : Chief Flnancial Officer - Dave Pitelka ILcgal- Jay Powers I Chief Operating Officer - Bill Taggart ICompliance- Scott Dario I Executive Search Consultant- Rick Carr to improve the IHuman Resources - Jim J£sposito I coordination and focus of :~~ ~n~g~~e~t.: ~~vi~ ~~n~s: CIB. The Corporate Client Business will be operated as a discreet unit and will report directly to Mr. Williams, who is tasked with tightening the strategic focus of this group. The change is a positive step in the structuring of the business and strengthening accountability within the organization.

Private Equity:

CONFIDENTIAL FCIC-134502 Restricted - F.R. The Head of CIB in conjunction with the Head of Investment banking appointed Scott Perper, Managing Partner of WCP, as the individual responsible for day-to-day merchant banking activity at the Corporation. Mr. Perper, with the assistance of a capable staff, ensures that adequate policies and procedures are established, reporting captures all risks embedded in the business, and there is an adequate control framework.

There are strong processes in place to ensure that critical information flows up the management hierarchy at the Corporation. Key members of senior management including the Head of Investment Banking, the CFO for CIB, CIB's Senior Risk Officer, the Head of Reporting and Accounting for the Corporation, and the Credit Risk Officer for the Corporation are voting members of the Valuation Oversight Committee (VOC). This committee was established in 2002 as a communication vehicle between WCP and the Market Risk Committee as well as to provide an independent review of valuations. Current events, quarterly business results, changes in strategy, and financial projections are communicated at these meetings. Additionally, the Head of CIB reports to the Board of Directors on a semiannual basis about activity in the business line.

Members of senior management are also involved in investment approval process as shown below:

Officer

New Product Approval: Satisfactory New Products Committee The new product approval process is satisfactory. Wachovia has established written Members policies and procedures for new product approval within the CTB Group Guidelines. cm Chief Financial Officer, Chairman This document outlines the definition of "new product," designates responsible parties cm Chief Risk Officer and their roles, explains required documentation, and provides a succinct roadmap of Managing Director-CIB Capital the process. Management Deputy General Counsel By definition, new products are any product or initiative that is not currently offered Managing Director-CIB Compliance by CIB and presents new credit, market, regulatory, legal or operational risks. Even Managing Director-Market Risk when a proposed new product differs slightly from, or is a variation of an existing Management product, there may be certain aspects (i.e., risk management, accounting, etc.) that are Managing Director-Wholesale Ops significant enough to require the product be evaluated as if it were a new product. Managing Director/CIO-Cm Specifically, characteristics that may require a product or change to be reviewed Teclmology include: Director-Business Risk Management • Would require a change to existing systems or procedures Corporate Tax Representative • Cannot be processed utilizing an existing system Others as appropriate • Does not readily fit into an existing risk measurement methodology • Cannot be priced through existing procedures or requires a new pricing model • Requires new credit or risk management policies or monitoring procedures to be established • Presents any unique regulatory, legal, reputation or other significant risk to the Corporation

For new products, the product sponsor is the group or individual who plans to develop and offer the product. The sponsor is responsible for conducting the initial due diligence and preparing a written proposal. This proposal is first presented to the CIB Risk-Return Committee, who gives conceptual approval, so long as the product is consistent with the goals and objectives of CIB and the Corporation. With that approval, the new product proposal is distributed to the New Products Committee members for review prior to the next monthly meeting. (Ad hoc meetings may also be held if the need arises.) The new products determine if additional due diligence is necessary, assist in identifying any risks and issues related to the new product, escalate significant issues to senior management, and provide 58

CONFIDENTIAL FCIC-134503 Restricted - F.R. approval/approval-with-limitations/denial. (Market Risk Oversight monitors compliance with any limitations that result from the approval process.) For each discipline represented on the New Products Committee, each is responsible for elevation of any significant concerns from their perspective. New Products Policy Administrators are responsible for ushering the Sponsors through the review and approval process, ensuring proper documentation is maintained, tracking issues, and providing a quarterly summary for each product to ALCO on a quarterly basis.

The New Products Committee also has the responsibility for establishing required follow-up reviews of approved products. These reviews are meant to ensure business line compliance with any commitments made during the approval process, assessing the current risk profile, and analyzing the financial performance.

Policies, Procedures, and Limits

Policies and Procedures: Fair

Policies and procedures are fair. High-level policies are adequate, but written procedures appear to be falling a bit behind practice changes as risk management moves to improve processes and MIS.

Policies and procedures are not consistently documented and there is no centralized MIS infrastmcture to assure maintenance of complete and current policies, making judgment on comprehensiveness difficult. Availability of polices is inconsistent. While management has initiated an internal website for CIB policies it is not up-to-date. Simple steps, such as dating policies as of the most recent revision and approval, are sometimes overlooked. Content of documents uses inconsistent nomenclature and organization stmctures. Several internal audit reports in the last year have criticized the sufficiency of policies. The new market risk management staff is in the process of refreshing policies, improving consistency, and adding approval dates. Examples noted during the May-June Market Risk Management Exam include the Market Risk Capital Policy, the Market Risk Policy, and the Market Risk Committee Charter.

In so far as policies are available, they have reflected the risk appetite ofthe Board of Directors. The main policy document, CIB Group Guidelines is approved by the Asset Liability Committee and states in very broad terms the risk appetite and major controls and responsibilities for market risk management. Much of this document states the ideal that is to be achieved but allows for variation in actual implementation. Products listed in this document are incomplete and general. One business line mentioned in some documents, Capital Management Group, is not described at all. Only three limits are documented in this policy, leaving other limits to be described in desk-level policies. The three stated limits are the VaR limits for all of CIB, equity capital markets, fixed income trading, and equity linked products. A stop loss limit is stated but defined as a guideline rather than a limit. Likewise the next level of policies includes the Market Risk Policy which is only a minimal document with very little detail. Desk level policies provide a more thorough description oflimits for the desks.

The most complete polices are those from the Finance group.

Policies and Procedures for private equity/merchant banking activities are considered comprehensive and establish an effective framework for decision making, monitoring, reporting, and compliance with regulation. In 2005, private equity investing outside ofthe primary business line increased. Wachovia's Corporate Compliance function helped to establish appropriate policies and procedures for this activity (i.e. Real Estate Capital Markets and Stmctured Products). These policies and procedures require a similar governance stmcture as those ofWCP.

Limits and Guidelines: Satisfactory

Limits and guidelines are established at the CIB Division level, for business lines and for all trading desks. At the desk level limits are quite comprehensive and include both VaR and non-VaR limits, as well as stress limits for some desks. This is especially tme for Structured Products, Rates, and Equity. Credit products relies primarily on credit spread DVOI and issuer limits. The OCC has noted that risk measurement for Credit products is limited. The four high-level VaR limits for CIB, Equity Capital Markets, Fixed Income trading, and Equity Linked Products are approved by the CIB Risk and Return Committee and its oversight bodies annually. 59

CONFIDENTIAL FCIC-134504 Restricted - F.R.

Risk managers are aware of business desk limits and guidelines, but these could be better documented and distributed outside of the Market Risk Oversight Group. The Market Risk Manager and CIB Head of Risk Management review and approve all of these lower-level limits and guidelines, though the policy doesn't require formal annual review. While daily risk reports include limit usage information for some businesses others report this information elsewhere and it is not part ofthe Market Risk Committee or CIB Risk and Retum Committee packages. The VaR limits are set well above normal usage levels, limiting its effectiveness as a market risk management tool. Guidelines for the Greek risk measures and other non-VaR guidelines serve as better risk management tools and are exceeded during volatile periods with management approval.

While limits are reasonable or conservative for this institution, the rationale for limit ranges and choice of guidelines is not documented. The overall VaR limit for CIB has been $30 MM for several years and most US desk level limits have not seen increases this year reflective managements caution while focusing on improvement in infrastructure.

Risk Management is responsive to particular risks for specific trading books. Commercial Mortgage trading, underwriting and securitization is a significant business for Wachovia and as such risk management has developed specific controls. The CMBS conduit interest rate risk is not part of the trading strategy and therefore a low interest rate DVOllimit is enforced. Spread risk versus Treasuries is also set low to avoid non-swap yield basis risk. Liquidity risk is managed by requiring the portfolio to turnover 3-6 times per year. Positions not securitized after 180 days are moved into a variance pool and liquidated as soon as possible.

A "high risk summary" is conducted periodically are reported by the CIB Risk and Return Committee. While not a strict limit or guideline this highlights the risk level and direction in subjective terms so that it can be viewed and managed as appropriate. In the February 2006 package it was noted that debt underwriting warehousing, interest rate proprietary trading, equity linked products, reputation risk and trading systems all represented high risk that was either increasing or stable.

Limits are independently monitored by Market Risk Oversight. Usage against limits is reported daily and overages are elevated to the proper business line and risk management levels. All usage information monitored by the Market Risk Oversight is on a T+ 1 basis. A well-defined approval process for overage exceptions has been documented. Internal Audit has only criticized this process only once in the last year relating to correlation trading. Due to industry-wide modeling errors limits were not being enforced as designed.

Private equity Direct Investments 2006 Carrying Value Limits (OOO's) portfolio limits are Well Established reasonable in light of the company's risk appetite and are effectively monitored. Aggregate portfolio limits are established on an annual basis by ALCO. Direct investment limits are broken down by the companies' stage in the life cycle. There are also direct portfolio limits for anyone investment, aggregate investment in anyone vertical, and holding period. Both the direct and funds portfolios receive an annual capital allocation, which totaled $350 million and $150 million, respectively, for 2006. These limits are monitored on a quarterly basis by the VOC and ALCO.

Risk Monitoring and Management Information Systems

V AR and Backtesting: Satisfactory

The VaR calculation covers material risks and can be reasonably aggregated. The risk measurement processes have 60

CONFIDENTIAL FCIC-134505 Restricted - F.R. been reviewed by the acc, FRB, and Intemal audit annually for many years. The acc has an outstanding MRA related to VaR methodology documentation. While there are numerous criticisms, many of these relate to technology and trading system insufficiencies rather than the risk management or VaR methodology. The current VaR platform, GRS, has proven to be unstable in years past. Stability was enhanced in 2005 with the replacement of operating system. GRS VaR production failures and restatements have been cut by 90%. GRS functionality doesn't meet management's desires, but its replacement has been delayed since 2005 due to project management ineffectiveness. The final roadblock to implementation of the new VaR system, (MARS) was crossed in mid-May 2006 with the implementation ofImagine version 6 for the equities area. With that, MARS completes User-Acceptance Testing and will be live in late-June. Finally getting this piece of infrastructure foundation in place will allow other project to move forward.

To reach the desired end-state for the technology infrastructure, management has outlined a three-year process. The efforts include time series data (mid-2006), better market data and pricing information (mid -2007), pricing applications (early-2007), and market risk applications (mid-2006). Some improvement has been noted over the past year, including the aforementioned additional staff that has been assigned to MRM and the restructure of market risk functions to analyze risk measures for VaR stress, and counterparty, control market data feeds for VaR, and ensure reliability of regulatory capital calculations and backtesting.

The VaR methodology is virtually the same as at the last RAP. For general VaR WAC uses historical simulation for daily holding period, at 97.5% confidence level, using 252 days of price information. The historical simulation method captures the historical distribution of daily changes in risk factors, and thus skewness. Historical simulation also captures convexity in the trading portfolio. As with other institutions, historical price changes are a combination of absolute and relative changes depending on the product. Many details regarding implementation for specific products are not discussed in policy documents and not easily available. Consequences of using proxies, or omitting certain risk sensitivities, is not discussed in policies or Committee minutes, though they are thoroughly vetted by Market Risk Management. There is no policy document that outlines the use of incomplete time series data, basis risk omissions, or disaggregation of baskets in calculating VaR. Given the extent complex structured and illiquid positions traded by Wachovia, it is likely that these procedures have a significant impact on VaR

The risk factors used for the historical simulation address interest rate risk, equity price risk, spread risk, correlation between risk factors, volatility, yield curve and spread curve (nine forward buckets are used), commodity risk and FX risk. For interest rate and credit derivatives, price distributions are established based on revaluations using the positions sensitivities to risk factor changes. Sensitivities used for these products are delta and gamma. For equity derivatives, the methodology employs full revaluation, using historical risk drivers rather than relying on sensitivities. Both of these methods capture the nonlinear price characteristics of option positions. Sensitivity to changes in volatility in the underlying rates and prices is applied based on measures of volatility on options at seven points on the curve for equities and two points for interest rate options per product.

The market risk system captures the majority of trading positions, however not all. There are four types of non integrated trades, which lack the significance to invest the time and money to integrate. The number of non-integrated trade types was significantly reduced in the period since the 2005 market risk management examination. The non integrated trades are addressed by establishing proxies for calculation within VaR, which are utilized to calculate regulatory capital manually using spreadsheets.

A specific risk model is used to calculate specific risk on most ofthe debt positions including; cash and synthetic collateralized debt, credit derivatives, asset backed securities, and commercial mortgage backed securities. This qualifies Wachovia for a 4-times multiplier for regulatory capital in lieu of standardized specific risk charges. The standard specific risk charge is applied to other products. The institution has been allowed by the regulators to combine Base VaR, modeled specific VaR and Standard specific VaR using a specified formula. Wachovia plans to move to a total risk model instead of separate models for general and specific risk. Development is planned for late 2007, with implementation by the end of 2008.

Daily backtests are performed at the 99% confidence level. Based on the Backtesting Policy, this is a manual process requiring calls to controllers for missing data after manually extracting VaR numbers and other inputs from various

CONFIDENTIAL FCIC-134506 Restricted - F.R. spread sheets. The Policy does not address clean P&L, P&L adjustments, or reserves. At the CIB level, there have been no backtesting exceptions in the last year. However, several ofthe business level backtests showed exceptions.

High-yield trading had one breach and corporate debt had four breaches due to CDS index tightening. Structured products as a whole had one breach due to correlation trading in the mezzanine tranche. Backtest reports further breakout structured products due to the significance of the desks. ARM's and high grade syndicate produce much more VaR that P&L moves would indicate. Global rates had two breaches. The Treasury group had 11 breaches indicating poor capture of market risk by VaR for this desk, though this needs to be considered in the context of the use ofthese positions to manage balance sheet risks.

Stress Testing: Satisfactory

Stressing testing is conducted and reported daily. There are consistent standard stresses run for all the books. Additionally, some desks have tailored stresses to reflect risk particularly threatening to those trades or to address weaknesses in the VaR methodology. The standard stresses are the same as in the past, composed of four historical scenarios (1987, 1994, 1998, and 9/11101), with the recent addition of a scenario that combines 1994 and 1998. Wachovia also uses a market shock series using a 4 standard deviation move in the risk drivers. The shocks are applied up and down to equity prices, equity vols, flattening rally and selloff, FX, foreign rates, FX vols, US spreads, Steepening rally and selloff, US swap spreads, US all vols, US non-mortgage vols, US basis, US curve, and US mortgage vols.

Some modification to the stress testing process has occurred recently. The historical scenarios were changed this year to tighten the window of price capture to more accurately represent the historical periods where significant market moves occurred and to limit the analysis more concisely to the periods where markets were illiquid. Management also introduced a new stress that captures the two-week worst move in non-overlapping 5-year periods. The flattening and steepening shocks were added this year based on 4 sigma move with one end flat the other moving up or down 4 sigma. This is applied to US Government and US Libor rates at 9 tenor buckets.

Diversification and correlation benefits are not changed by running these stress tests. Ad hoc stresses, when conducted, are not reported to the Risk Management or CIB Risk and Return committee. Interdependence of credit, market, and liquidity risks are not considered. Hypothetical scenarios have been suggested by regulators as an appropriate enhancement to stress testing. This has not yet been adopted.

Management Reporting and MIS: Fair

Management reporting systems are fair, capturing risks and reporting them in a timely manner to the appropriate members of management and committees. Reporting continues to improve and has proper emphasis under the new head ofCIB Market Risk Management, though it still lags expectations for an institution with Wachovia's activities. While reports and MIS capture risk, technology and project management issues have delayed improvement in this risk capture. Infrastructure weaknesses continue to necessitate human intervention and manual processes to compile the complete risk picture for the organization. Management appears to have committed sufficient financial and human resources to the area to improve market risk management, though this will be a multi-year project to reach management's desired state. More staff and funding may not improve the pace of development at this point as many of the infrastructure projects follow a building-block process, where improvements must be made sequentially.

MIS is fractured, with reporting coming from several different groups and systems. Without a centralized MIS infrastructure, consistent and accurate reporting or market risk to senior management cannot be ensured. While a centralized reporting engine would be the ideal, several other infrastructure projects must occur first.

There are many manual processes used in the aggregation and reporting of risk and backtesting. Trading positions reside on nine main systems and the use of numerous spreadsheets slows the production of reports. P &L analysis is likewise inconsistent with P&L attribution only occurring at a high-level. Late reporting ofP&L and VaR had been routine in years past, but was much improved in 2005 as some technology issues were remediated within the GRS system. 62

CONFIDENTIAL FCIC-134507 Restricted - F.R.

Wachovia does not report proprietary trading separately from the customer flow business, noting that proprietary activity is still quite limited. Separating the reporting would help quantify the significance of this activity. Reporting should also be expanded to formally include a discussion oflarge gains and losses. Often times, transactions which produce extreme results could provide worthwhile insight into risks, customer relationships, and control environment. There is no reporting of trades or desks incurring tail risk and market risk exposure to large market swings not captured in the 97.5% confidence level. While stress testing captures some of this risk it is not isolated to particular desks or transactions, nor is it measured against limits.

The CIB Risk and Return package does not include changes in P&L reserves, aged inventory information, nor does it have updates on technology initiatives. The package is currently being reconsidered by Market Risk Management to ensure the right information is being provided, balancing volume and manageability.

The Market Risk Oversight personnel have begun to improve desk-level reporting, but these are in various stages of completion depending on the desk. Daily desk level reporting has improved significantly since in the past year. Daily desk risk reports are particularly good for rates and correlation trading, with the reporting of exposures measured by the Greeks and limit utilization. Limit usage information is inconsistent on these reports, but is expected to improve as these reports move through development The equity desk report is the least developed, not even including VaR information at this point. The CIB Risk and Return or Market Risk Committee reports also lack some VaR Greek and stress limit usage is reported to these committees; however, limit overage exceptions are included.

One project that has suffered implementation delays is the upgrade of the VaR system, from GRS to MARS. MARS is in the user-acceptance-testing stage and should be implemented by mid-year, but this represents a significant delay from the original 2005 date. The GRS system is unable to capture foreign currency exposure related to the bank's investment portfolio, treasury-lock positions, trans-option positions, AMNet hedges or HELOCs, requiring manual intervention to calculate the overall VaR position.

Management reporting and MIS within WCP is manually intensive, as the Corporation has chosen not to purchase a centralized investment management system for their private equity activities. The majority of investment information is maintained in Microsoft Excel and Access databases. Two separate reporting systems are employed to track fund and direct investments. A third database is used to track regulatory authority assignments and percentage ownership. This database is owned by Corporate Compliance. Additionally, the Treasury Department kept an equity investment database to track investments made at the corporate level. Treasury recently discontinued maintenance ofthe database and passed off ownership to External Reporting. It is evident from our ongoing monitoring process that this tracking database is in a period of transition and is most likely out of date. Although the management reporting structure is piecemeal and manually intensive, business line personnel are able to produce reports that capture the majority of the aggregate and relative risk to the Corporation.

A matter requiring attention related to regulatory reporting was noted during the 2005 Equity Investment Inspection. Several errors were found in the June 30, 2005 FRY -12 regulatory report. Most of the errors can be characterized as "slotting" errors, although we also found at least two investments that should have been reported and were not as well as an overstatement of acquisition cost in the amount of $38.8 million. This issue speaks to the challenge in aggregating data from Wachovia's many equity databases.

CONFIDENTIAL FCIC-134508 Restricted - F.R.

Key Reports:

The key management reports and the general Market Risk Committee Minutes contents are included in the adjacent table. Each Package Backtesting results committee report is tailored to the goals of the (Quarterly) VaR Charts across products Stress T . constituents, ensuring that the groups receive the CIB Results Executive Summary necessary information. (Quarterly) Income, Expenses Trading Variances, While management has a variety of reports upon Segment Details which they can base their decisions, there are Lending Metrics (performance, warehouse, some noticeable gaps. One report that an Backtests for aggregate and individual VaRs organization ofWachovia's size would be expected to produce is a detailed P&L attribution CIB Risk-Return Package Minutes report. Such a report can identify the profits and (Monthly) Market Summary losses that are associated with risks taken; for Summaries for Market, Credit, and Ops Risk example, the profit/loss associated with the Comprehensive Risk Summary Risk Focus Reports amount of delta/gamma/vega risk take. Another Risk Data Books useful tool would be intraday MIS, which is Update currently limited to only certain products such as foreign exchange. Also on management's list of Pixed Income Division Market Risk Commentaries desired reports is a desk level trader tracking by Packagc Asymmetrical Accounting (Monthly) Monthly IQuarterly Analysis strategy, to ensure that traders are remaining IncomelExpenselBalance Sheet within their stated strategy. AMNet, Global Rates, Credit Products, Structured Products Trade Capture Process: Fair Equity Division Package Market Conditions (Monthly) Performance, Financial Scorecard Other Trade capture and trading systems in general have Market Risk Reports Summaries for Global Markets, Credit been recognized by management, regulators, (Weekly) Products, Structured Products, Equity, and external and internal auditors as a concern and overall position constraint to further business development. Risk metrics, linlits, and scenario analysis Management has further signaled that systems risk are included in the is high and increasing. As discussed earlier in this document, many projects are underway, but the sequential nature of the infrastructure projects means that many will not be completed for two or more years. Internal audit has further criticized the reliance on spread sheets and the lack of control environment around these.

Straight through processing has been attained on two of the main trading systems including Calypso used for rates and FX and Imagine used for equity derivatives. This represents between 50% and 70% of the transaction volume, however much of the market risk is in complex structured products which have manual processes and spreadsheet use.

The OCC has noted that compensating process controls and low limits have been put into place to mitigate this risk. The extent of new product approvals and growth of products has been restrained until better systems are in place. Management has indicated that they will continue to restrain expansion in activity in areas where infrastructure is not yet adequate. Ongoing supervision will monitor these restraints.

Internal Controls and Audit

Reserves: Satisfactory

The reserve methodology is formalized in policies for Structured Products, Rates, Credit Products and Equity-Linked Products and meets the standards for a satisfactory rating. Major reserve classes covered include EITF 02-03 reserves, model reserves, liquidity reserves, credit reserves and operational reserves. Policies include a discussion ofthe release of major reserves. A reserve report is prepared and distributed monthly, but not included in the main MIS packages. 64

CONFIDENTIAL FCIC-134509 Restricted - F.R. Most of the reserving methods are manual processes.

For equity derivatives, model reserves are calculated on a portfolio basis each quarter. The amount taken is based on dealer quotes, which are compared to model driven prices translating differences into volatility point changes to be applied to the entire portfolio of like products. Variation in dealer quotes and portfolio composition will alter the reserved amount. The reserving combines aspects of price verification and model reserve calculation. Typically, the model reserve calculation is adjusted for position changes but not model accuracy changes unless the model has been altered.

Total returns swaps have a reserve for operational losses (not administrative costs) because of the manual process involved in calculating the value of the trade. It is calculated quarterly and is generally 25bp ofthe funded portion (hedge amount) of the trade. This is not truly a pricing reserve but an operational error reserve, and provides an indication that the business growth is ahead ofthe infrastructure.

For synthetic-CDS and Correlation trading four reserves are maintained: EITF 02-03, substitution rights, liquidity, and correlation reserve (also referred to in the industry as model reserve). According to the policy EITF 02-03 reserves are still maintained on all synthetic-CDO's, including single tranche index trades as well as bespoke trades. The policy also states that CDO's on indexes tranches are recognized in revenue and only bespoke are reserved (this is consistent with industry). No EITF reserves are held for single-name CDS.

The substitution reserve accommodates the contingency, allowed in some transactions, which grants the investor the right to substitute a different name for one or more names in the reference pool. A cap is established so that the P&L difference caused by the substitution does not exceed the cap. The reserve covers the amount of the cap and is released during the life of the trades as substitutions are made or at the maturity of the transaction. This is an option feature and should be incorporated in the price of the transaction or established as a model reserve.

A Liquidity reserve for synthetic CDO's, as with other derivatives, allows the trade to be marked to the mid point with a price adjustment to the bid or ask as appropriate. On each trade the liquidity reserve is calculated and aggregated by reference entity and all entities summed for the portfolio. This process is done monthly.

Correlation liquidity reserve adjusts for use of the midpoint mark in the calculation ofthe base correlation. Broker correlation quotes on various indices are used to model bid, offer and midpoint implied correlations. The midpoint correlation is used as input to produce base correlations for valuing synthetic CDO's. As with single-name CDS an adjustment is made to allow for the difference in pricing tranches at the bid or offer versus the midpoint. This process is done monthly.

For the rates desks an operational reserve and a bid/offer reserve is calculated quarterly on a portfolio basis. The bid offer reserve is based on sensitivities of the positions and is broken into two parts; a delta reserve and a volatility reserve. All the delta sensitivities along a series of curve vectors are generated. The cost of exiting a position is assumed to be 2 basis points at each curve vector (difference in the mid point and bid or ask). So the total delta reserve is 2* Gross DVO 1. The volatility spread is estimated to be 50% of the 12-month average variance between the MRM (price verification) option valuation, and the Options desk's valuation. These two amounts are added for the bid ask reserve. This process is more closely akin to a price verification procedure than a bid/ask reserve and is calculated differently in other institutions.

Areas where the policies could be strengthened include: • There is no distinction made between reserves and valuation adjustments. • There is no discussion of adjustments for exchange traded or externally priced instruments. • Some details regarding calculations are not clear with the exception of synthetic CDO's. • Many reserves are calculated on a quarterly basis which is inconsistent with the price verification policy. • Two reserves suggest implicit recourse for securitizations and require further research (Large loan group and equity tranche reserve). • Balance guaranty swaps are defined as fixedlfloating swaps with an SPE; however, these are subject to EITF 02- 03 reserves while other amortizing interest rate swaps are not. The difference is not discussed in the policy. 65

CONFIDENTIAL FCIC-134510 Restricted - F.R.

Price Testing: Satisfactory

Finance is responsible for establishing and enforcing corporate accounting policies, P&L generation and reconciliation, aged inventory monitoring and reporting, and market valuation/verification. Finance is independent of the front office. Price verification is conducted bi-monthly for most products. A monthly price verification report is produced, discussed with business heads and the CIB Risk and Return Committee, but is not part of the Committee package. While a process for price disputes is not memorialized in the policy, the transparency of reporting price uncertainties combined with conservative aging practices, serve as an effective control. Sources of price verification are approved by finance, MRM, and the business lines, and are properly documented.

According to the OCC, no vendor pricing is available for 21 % of the trading book. This includes loan trading and variable rate notes. Non-vendor sources include matrix pricing. Wachovia recalculates model pricing using broker quotes for key inputs, considering it to be vendor pricing.

Price verification policies and procedures is particularly well defined for the CDS, synthetic CDO, and synthetic CDO;\2 transactions. This is appropriate given the heavy model reliance and non-observable inputs. Price verification for these trades involves finance independently deriving the implied correlation using the approved model. Finance obtains bid/offer quotes from brokers and calculates the implied correlations based on these quotes. The other pricing inputs include CDS spreads, interest rate swap curve, and recovery rate assumptions. These are easily obtained independently in the market.

Audit comments note that pricing for high-yield is very subjective, especially when Wachovia is the lead trader of a bond. Pricing is reviewed by Finance twice monthly and they do challenge the marks when there is disagreement. 90% of the desk activity is bonds brought to market by Wachovia and the rest relates to the high-yield portfolio held at the holding company.

A key aspect of the pricing policy is to closely monitor aged inventory with the philosophy that the older the positions, the less reliable the price. Positions are subject to additional mark downs after 90 and 180 days. After 90 days positions are put on a watch list and when sold the realized P&L is compared against the trader mark.

Investment grade CDS are verified by inputs from ValuSpread Credit Data vendor pricing service.

Wachovia's price testing and control practices are considered satisfactory for private equity investments. WCP's has a semiannual review process for direct private equity investments, which entails the individual deal professionals assigning valuations to their portfolio of investments. The deal professionals' valuations are independently reviewed by CIB Finance and WCP's Portfolio Management Group. Additionally, the Commitment Committee reviews investments that meet certain criteria including investments on the Watch List, investments with a book value greater than $25 million, investments with a significant event on the horizon, and investments with two consecutive quarters of performance.

While WCP's valuation process is considered adequate, non-WCP private equity investment monitoring was criticized during the 2005 Equity Investment Inspection. Specifically, we found files that had stale financial information and analysis, and investments that had questionable carry values based upon the financials in the file. In fact, management wrote off one ofthe investments we reviewed after we discussed the validity of the valuation with the designated contact person. Furthermore, a relationship manager, Compliance contact, and Legal contact were not indicated for every investment. These investments make up a small portion of total equity investing; thus, a more critical rating for price testing and control practices is not warranted.

Model Review and Validation: Satisfactory

Model review is the responsibility ofMRM and is independent ofthe model development. This includes documentation of assumptions and full testing. Models may be used on a limited basis before complete validation if so 66

CONFIDENTIAL FCIC-134511 Restricted - F.R. approved by MRM. A model used for only one transaction does not need to be in the inventory, but still must be reviewed for materiality.

Model validation is to cover both in-house and vendor developed models. The validation of vendor models must be independent of those making the purchase decision. The validation policy proscribes procedures as follows: • All components, input processing and output should be reviewed • The quality of data inputs should be reviewed unless explicitly assigned to another Wachovia team • Review should consider the range of inputs for which the model will be used • Impact of model assumption or approximations should be assessed • Underlying theory should be reviewed • Backtesting and calibration should be performed for all statistical models

The validation report and documentation should include: the scope, model description, intended use, assessment of inputs, assessment of implementation, description of validation methodology, description of testing, and critical analysis.

MRM has validatcd thc significant modcls bascd on OCC and FRB cxaminations.

In spite of the comprehensive policy and general compliance, the OCC has an MRA outstanding addressing the insufficiency of model validation documentation. Internal audit in the past year has criticized some feeder models not being validated and some model adjustments not being validated as mandated by the policy. In strategy documents management has noted that a significant risk facing the company is inaccurate model validation or implementation which could result in overestimation of profitability or underestimation of risk. Finally the joint FRB and OCC Market risk control examination of 2005 noted deficiencies in model validation due to insufficient staff creating backlogs or incomplete documentation. Based upon the progress of the 2006 Market Risk Control examination, it appears that these issues have been remediated. In addition, the Market Risk Management validation group now has oversight responsibilities for all corporate-wide model validation.

A material models inventory is maintained, which presents models in easily understood terms, outlining the models purpose and objectives, major assumptions and theories, data inputs, dependence on other models for inputs, and limitations of the model. The model inventory has not been subject to a specific audit. Updates to the VaR model were not reflected in the current inventory.

A model is deemed material if it: • Has direct and significant impact on books and records • Directly used in a decision to enter or exit business segments • Is used to make pricing decisions • Provides basis for material risk decisions • Is the source of forecasted financial results related to transactions

Thresholds for materiality are: revenue or expense impact of$lO million whether financial reporting error or PIL; an asset, liability or capital impact of $100 million; customer impact of 5,000 customers or reputational risk to a few customers.

Outside model validators may be used ifMRM is provided with qualifications, validation procedures intended, documentation of validation, and final approval by MRM.

Models are to be reviewed annually to assess continued appropriateness, and should include any changes to the model, or the way it is used, assessment of performance, and changes to inputs.

While not traditional model validation, management is in the process of instituting a validation process for one-off trading models. This is a reactive measure in response to the issues surrounding the Bombardier Aircraft securitization that had scvcral crrors. Thc proccss has not bccn formalizcd, but thc plan is to havc a validation group within thc

CONFIDENTIAL FCIC-134512 Restricted - F.R. syndication group that will review models prior to pricing. Fonnerly, there was reliance on extemal parties, such as consultants and legal, to capture errors, and the syndication group only reviewed models after-the-fact to assist the traders in secondary marketing. The process change is subject to ongoing regulatory supervision.

Intemal Audit: Satisfactory

Audit is satisfactory in coverage and quality of reviews. Audit staff dedicated to coverage of CIB activities is stable at 35, allowing sufficient coverage of the variety of activities. The audit schedule for 200617 covers the major desks, products, and locations. The audits reviewed showed adequate documentation and elevation of findings, tracking of issues/responses, and reflected sufficient understanding of the activity by the audit staff.

Audit is considered adequate and has an average skill-set for assessing private equity activities at the Corporation. The audit partners are much stronger in the operational review of this area than in valuation assessment and management reporting adequacy. Although audit lacks a desired skill set for valuation reviews, Credit Risk Review serves as a solid independent review function for this area. Credit Risk Review recently provided value to the primary business line by back testing a new fund rating process that was designed to predict potential write-offs. Together Audit and Credit Risk Review serve as a strong control function for equity investing.

Audit coverage of CIB was assessed utilizing a limited sample of audits, discussions with the OCC, discussions with audit staff and review of the audit plan. CIB Audit represents a knowledge gap that will be filled through ongoing supervision with the review of audit work papers and reports, as well as regularly scheduled meetings with management.

CONFIDENTIAL FCIC-134513 Restricted - F.R. Banking Book

Inherent Risk

Although Wachovia is a large and complex institution, management has a conservative philosophy that is evident in the Balance Sheet Positioning and Hedging Strategy that present a limited inherent risk environment. Risk posed by the size and complexity of business activity (mortgage portfolio, broad types ofIRR, interest sensitive revenue) is managed away through the strategic balance sheet decisions and the use off-balance sheet derivatives.

Size and Complexity of Position Exposures to Interest Rate Changes: Moderate By definition, the size and complexity of position exposures to interest rate changes present moderate risk to the company. Wachovia is a large institution with a complex balance sheet. Although management is effective at hcdging this risk, thc nakcd positions would prcscnt significant risk. Wachovia has a sizable mortgagc-relatcd portfolio that displays considerable prepayment, extension, and convexity risk.

As of February 28, 2006, the AFS portfolio had a total book value of$118.3 billion. Mortgage-related products represented 85.6% ofthe portfolio, or $101.3 billion, which includes $6.0 billion of Danish MBS. At that time, the portfolio displayed an unrealized loss of $672.7 million. In addition, there are roughly $30 billion in whole loans managed by the Treasury. Clearly, mortgages represent a substantial interest rate risk.

Management has historically taken a conservative approach to interest rate risk management, though, and effectively hedges much of this risk, which accounts for the overall limited inherent profile.

Balance Sheet Positioning: Umited Management has consistently maintained a conservative approach to interest rate risk management. The general strategy has been to produce stable net interest income without incurring excessive interest rate risk. While management does assess the direction of rates and structures the balance sheet accordingly, they want no undue risk posed by interest rate risk. Over the past year, the strategy has been relatively successful. While the net interest margin declined, it fared better than peer institutions. Meanwhile, the Earnings-at-Risk measurement resided within a range of 1.0% to (2.2%) of net income, casually migrating toward more liability-sensitivity until March 2006 when management chose to return to a neutral posture. The trend is depicted below.

CONFIDENTIAL FCIC-134514 Restricted - F.R.

WB EaR March 2005-2006

$0.06

$0.04

$0.02 0.5%

$(0.02)

$(0.04)

$(0.06)

-1.5% $(0.08)

-2.0% $(0.10)

$(0.12)

___ Composite __ EPS I

Management approved of this migration because they believed rates would not rise as quickly as the market implied. Wachovia uses the implied forward curve for its rate stresses, so the liability sensitivity is to the forward curve. The recent move toward neutrality suggests management's uncertainty regarding the future of rates. A neutral short-term posture provides more flexibility to react to rate changes.

CONFIDENTIAL FCIC-134515 Restricted - F.R.

As of March 2006, the composite measurement projected a 0.5% decline in net income. The composite is compiled using the market rate curve adjusted for varying spreads between FF and TYI0 and then shocked gradually upward 200 bps. The three scenarios reflect an Upward Non-Parallel Shift with 2-Year Rates Less Steepening, Upward Non Parallel Shift with 2-Year Rates Quickly Steepening, and an Upward Parallel Shift. The most severe of these scenarios would be the parallel shift, but even that would only result in net income falling 1.1 %. A fourth scenario is included in the monthly results, though not in the composite, that is a Downward Non-Parallel Shift with Steepening. This shows 0.9% increase in net income. The table below depicts the results.

Wachovia March :2006 ",e!l!1IUVIThI 1='.... "1111-111'11'1 Restructuring and Gains

D F

PnltiIx Vilue of EPS $0.01 EPS

1),1)0 0.05

5.20

CONFIDENTIAL FCIC-134516 Restricted - F.R. Long-tenn interest rate risk is measured using EVE and is produced quarterly. March 2006 WB EVE Sensitivity results from EVE indicate a moderate risk 01 2005 02 2005 00% ~~~ ~.~~ posture, 10.5% liability-sensitive in a +200 shock. Although a 3Q05 EVE analysis was not -2.0% run due to the BancWare implementation, the level of sensitivity increased from 6.7% at 2Q05, primarily due to rate increases and -40% balance sheet growth. The overwhelming contributor to this exposure is the -6.0% preponderance of mortgage assets. Included in this analysis are ALCO-approved assumption -80% changes for both deposit lives (lengthened) and

goodwill (removed) during 3Q05. The changes -10.0% resulted in 4.6% less sensitivity for the June 2005 calculation. The trend through 2005 is shown in the adjacent chart.

Size and Stability of Interest Sensitive Earnings and Capital at Risk: Limited

Interest sensitive earnings are moderate with Trend in Net Interest Margin by Quarters respect to total revenues at 50.2% for lQ06. 3.70 Consequently, the flat yield curve has hampered 3.63 GWachovia Wachovia's net interest margin (NIM) over the D Peer Average past few quarters. From YE 2004 to YE 2005, 3.60

Wachovia's NIM fell by 12 bps. However, 3.50 Wachovia has fared better than its peers whose NIM compressed 32 bps. Deposit pricing 3.40 elasticity explains part of this. Wachovia benefits from a stable core deposit base that is 3.30

loyal due to strong customer service. Q) z 3.20 Consequently, management has not raised

deposit rates commensurate with the market. 3.10 The aforementioned changes to deposit betas for EVE are evidence of this elasticity. The 3.00 ability to hold down funding costs while short 2004 Q4 200501 2005 Q2 200503 2005 Q4 tenn rates are rising clearly benefits the NIM, Source: Kevin Littler, FRB Wachovia especially whenlong-tenn rates and revenues do not enjoy the same benefit.

Hedging Strategy: Limited Management's conservative IRR strategy is dependant on active hedging. Historically, the core bank has been asset sensitive and management has used received-fixed swaps to neutralize the bank. While this remains an active strategy, recent asset growth has largely been in fixed rate consumer loans, creating more liability-sensitivity. Recent hedging activity used to offset this exposure included long Eurodollar puts, a long cap, and the unwinding of some receive fixed positions. These are the primary actions used to reduce liability-sensitivity reported in the February EAR summary from 1.5% to just 0.5%. Management anticipates increased hedging activity to maintain a neutral posture.

Types of IRR: Moderate Wachovia is exposed to moderate levels of other IRR including repricing, basis, yield curve, and options risk, though is effective at managing the risk. Repricing risk, as indicated in the discussion of earnings stability, is modest. Although Wachovia suffered margin compression over the recent rate cycle, they perfonned better than peer companies. Although much of the current asset growth has been fixed-rate, deposit elasticity has softened the impact of recent rate increases. 72

CONFIDENTIAL FCIC-134517 Restricted - F.R.

Basis risk is moderate. Management has created scenario analysis around basis risk, but has not produced the analysis since April 2005. At that time, the primary risk was between prime-based and fed funds products. Management needs to produce this more frequently, but the delayed BancWare implementation has created several oversights in day-to day activities.

Yield curve risk is captured in ongoing scenario analysis. Along with the primary scenarios included monthly in ALCO, the Corporate Forecasting Group (CFG) runs several other scenarios (up to 22) that incorporate various yield curve shifts and shapes. In determining the primary scenarios, management takes a view on the current shape of the curve, the implied forward curve, and the most likely curve scenarios one-year out. Consequently, given the current flat curve, flattening scenarios are limited, with management focusing more on steepening curves.

Options risk is considerable given the preponderance of mortgage assets on the balance sheet. Based on different rate cycles, Wachovia can be exposed to significant convexity or prepayment risk. With RADAR, the process to capture mortgage option risk was manually intensive and included input from Yieldbook, INTEX, and a two-dimensional table. Though effective, the process is highly inefficient. With BancWare, Wachovia will be using ADCO, supported by BancWare and making it a more automated process.

CONFIDENTIAL FCIC-134518 Restricted - F.R.

Banking Book Risk Management and Controls

Banking Book Market Risk Management and Controls

Supporting Analysis

Risk management practices support an adequate control environment and clear reporting structure. Policies, procedures, and risk limits are reasonable and reporting sufficiently informs senior management of exposure. Additionally, management's success in consistently maintaining a neutral short-term posture reflects an effective and knowledgeable staff. However, management has not satisfactorily managed the implementation of its new interest rate risk model, resulting in significant delays and documentation weaknesses. Fortunately, the implementation process is reaching a conclusion and upon completion, the reporting process will allow for improved analysis.

Board and Senior Management Oversight

Board Governance, Structure, and Oversight: Satisfactory

The current Board of Directors is an eighteen member group of experienced and individually successful bankers, business owners, and managers with numerous outside interests. The president of the bank is also the Chairman of the Board. The broad diversity of Board membership adds a high degree of business expertise and acumen to the leadership. The Board uses two main committees to oversee corporate risks, the Audit Committee and Risk Committee (flk/a/ Credit and Finance Committee). These two groups meet bi-monthly to discuss the highest risks facing the company. The Board is viewed as capable, appropriately engaged in the management of the company, and responsive to regulatory issues.

The Board has delegated oversight of the interest rate risk function to several committees, with responsibilities narrowing down the hierarchy. The Board's Risk policy delegates oversight to the Risk Committee (RC) of the Board, which is comprised of three non-management directors, and which further delegates risk oversight to the Senior Risk Committee (SRC) consisting of senior management. SRC oversees the risk governance structure for all risks (including market and consequently interest rate), monitors the direction and trend of risks relative to business strategies and market conditions, and directs operational actions. The Board designates primary oversight of the interest rate risk function to the AssetlLiability Committee (ALCO).

Reports presented to the SRC and RC do not require the detail presented in ALCO reports, but do protlie the risk exposure ofthe company to facilitate discussion among the highest levels of management. Limits and trends are reported. Discussions at these meetings demonstrate an engaged directorate knowledgeable enough to pinpoint key issues and drivers of key risks. Policies approved by the Board address the significant risk areas and assign responsibility of daily oversight to appropriate management.

CONFIDENTIAL FCIC-134519 Restricted - F.R. Senior Management Govemance, Structure, and Oversight: Satisfactory

Senior management adequately oversees IRR. The function is managed by a knowledgeable, though historically lean staff that is highly attuned to the daily supervision responsibilities. They have developed effective, though inefficient methods to work around the weaknesses in RADAR. While project planning deficiencies reflect poorly on management, they do not outweigh the sufficient control environment management has instituted. Management has been responsive to audit and regulatory concems around project management and remains on schedule to have ALM5 operational for the September 2006 EAR forecast. Most delays since the project planning weaknesses were highlighted have been due to technical issues with BancWare. Management has worked closely with BancWare to resolve these issues.

As discussed above, ALCO is delegated with primary responsibility for IRR. ALCO comprises members from each division of Treasury, as well as representatives from Wachovia's business groups and risk management. Meetings are held monthly with CFO Tom Wurtz (formerly Bob Kelly) as Chairman. ALCO serves as the primary committee for IRR, as opposed to liquidity and the Liquidity and Capital Planning Committee. The head ofCFG meets monthly with ALCO to present the current EAR or EVE analysis. ALCO discussions are comprehensive and draw the attention of senior management, evidenced by recent changes to EAR and EVE report layout advised by former CFO Kelly.

Under the purview of ALCO is the Treasury Committee, a similar makeup to ALCO, but consisting more of staff with direct responsibilities over Treasury functions. Generally, the Treasury Committee meets semi-monthly. Discussions are more detailed in nature as opposed to ALCO, but consist of similar discussion items. CFG's head participates on Treasury Committee, as well as the Liquidity and Liability Management Committee and New Product Committee. This helps ensure all risks are incorporated into the IRR analysis.

Treasury Risk Management (RM) represents a clear independence from the business units. Influence is adequate and the stature and responsibilities are improving. RM still serves as a facilitator between regulators and audit with the business function. They work with Compliance to ensure limits are met and reported appropriately. When deficiencies are noted by regulators or intemal audit, RM works with the business function to address those deficiencies in a timely fashion. RM has been instrumental in reviving the idle New Product Committee.

Day-to-day supervision of interest rate risk is adequate. Staff is knowledgeable and reporting to senior management is sufficient. Staffing levels have been lean in the Corporate Forecast Group (CFG), the division of Treasury that completes interest rate risk analysis. This has been highly evident through the recent implementation of the BancWare ALM5 model. Although management has hired a handful of people over the past year, they provide limited assistance in implementing the new model or performing day-to-day activities in RADAR. Why instruct them on how to use RADAR when BancWare will be active in a few months? Consequently, upon completion of the implementation, CFG will be more adequately staffed, but until then the current staff remains burdened. A benefit ofthe day-to-day staff implementing the model will be their familiarity with not just ALM5, but also increasing knowledge of assumption development, modeling, and reporting.

The BancWare model is now on target to be implemented for EAR by September 2006 and EVE by year-end (YE) 2006. Over the past few months, management has been working closely with BancWare to fix the remaining bugs. At this point, ALM5 could be implemented with similar workarounds to the current RADAR model. Although the outstanding issues are largely technical in nature, weaknesses in project planning have contributed to the delays. The move to ALM5 was a reactionary decision, largely driven by regulatory concem, though management is now eager to access the improved capabilities of the software and enhance the analysis.

Management has been responsive to audit and regulatory concems, working to address project planning deficiencies while struggling with the ongoing technical weaknesses in ALM5. Wachovia has essentially driven the development of ALM5 and beta-tested each new release, but management believes the finished product will be a leading ALM risk model. Management has also provided more frequent and thorough updates of the implementation progress. While the weakness in project management is a considerable factor in rating management, it does not taint the effectiveness of overall daily operation. Given management's responses to the identitled weaknesses and adequate control 75

CONFIDENTIAL FCIC-134520 Restricted - F.R. environment, the rating remains satisfactory.

New Product Approval: Fair

The New Product Committee was only recently formalized after a year of inactivity. While this inactivity is due partly to weak commitment to the process, it also reflects the historically limited volume of new products flowing through Treasury. The move to formalize the process now is driven by management's desire to increase the development of new products on the investment side with the advent of BlackRock. Prior inactivity presents limited regulatory concern that significant risk flowed through due to the infrequent creation of new products.

A new NPA Charter was written detailing appropriate membership, duties, authority, and reporting. Upon initial review, the charter satisfactorily addresses regulatory guidance. Given the relative infancy ofthis process, it is premature to consider NPA satisfactory. However, should the charter be met, it is likely the rating will be upgraded at the next assessment. In the initial minutes, the purpose was described, "to review all investments and transactions that entail new processes that are not currently supported by Accounting, Operations, Technology, Risk Management, etc." The Committee will meet monthly and use a template for presentations. We will receive monthly minutes of the meetings.

Policies, Procedures, and Limits

Policies and Procedures: Satisfactory

Interest rate risk is governed by the Balance Sheet Management Guidelines (Guidelines), last updated December 2005. Roles, responsibilities, and reporting lines are clearly outlined in the policy. ALCO is designated with "responsibility for managing the interest rate sensitivity of the Corporation, but selective limits have been further delegated to specific individuals within the Treasury Group to allow for action if conditions warrant. ALCO will be informed as soon as possible after any of the limits are utilized."

Balance Sheet Management (BSM) is the group assigned responsibility to analyze and execute ALM transactions. Appropriately, BSM reports on earnings forecasts, rate sensitivity analysis, and limit exceptions to ALCO. Within this constmct is CFG, who is responsible for daily operation of the model, assumptions, and analysis of output.

The Guidelines discuss major risks and regular reports that pertain to those risks. Reports include earnings forecasts and rate sensitivity analysis, unrealized gains/losses in certain financial instmments, available-for-sale unrealized gains/losses, summary of recent portfolio transactions, Eurodollar hedge settlements, and portfolio summaries. Distribution of those reports is specifically to ALCO with broader discussion at the SRC level.

The Guidelines do reflect current practice with a large focus on short-term risk (I-year Net Income). While appropriate attention is given to EVE, management puts more emphasis on its EAR measure, given its income focus and more immediate impact. Consequently, EAR is produced monthly while EVE just quarterly.

Limits and Guidelines: Satisfactory

Management has developed limits for both short-term (income simulation) and long-term (economic value of equity) exposure that are reasonable and commensurate with the size and complexity of the institution. The limits do not reflect the full suite of scenario analysis completed by CFG and are broadly written for relevancy in any rate envirol1111ent.

Short-term sensitivity is monitored using Earnings at Risk analysis over a twelve month period. The limit restricts a negative impact to consolidated net earnings to no greater than 5% over the policy period in a +/- 200 bps shock. Rate movements are ramped each month to 200 bps over the twelve month period. However, the Guidelines are not consistent with the current scenarios CFG uses to deternline policy compliance. The Guidelines describe the composite as a mix of the "Flat Rate", "High Rate", and "Low Rate" scenarios. In reality, the composite scenarios change monthly to reflect management's most likely rate views. For instance, the most recent scenarios describe an 76

CONFIDENTIAL FCIC-134521 Restricted - F.R. upward parallel shift, a moderate steepening, and quick steepening. Management should consider language that more appropriately reflects the dynamic methods used to monitor EAR.

A suite of 22 EAR scenarios are typically run monthly, though management has failed to complete all scenarios occasionally due to BancWare implementation demands. The scenarios change month-to-month based upon the current market forecast. Each scenario is developed based upon some shift or twist in the yield curve and are described as such. The most recent suite of scenarios is provided below.

Scenario Description Market Market scenario based on current market fOlWards MPHYI Scenario built from the market scenario in which a Scenario 1 Parallel +200 basis point ramp is introduced in months 2 through 12 of the policy period with the increase of In ALCO Package Fed Funds being approximately 18 bps every month of the ramp. The shift in the curve is parallel so that the shape of the curve remains consistent with that of the market at the end of the policy period. MPLYI Scenario built from the market scenario in which a - 200 basis point ramp is introduced in months 2 through 12 of thc policy pcriod with thc dccrcasc of Fed Funds being approximately -18 bps every month of the ramp. The shift in the curve is parallel so that the shape of the curve remains consistent with that of the market at the end of the policy period. MHYI Scenario built from the market scenario in which a Scenario 3 Non-Parallel +200 basis point ramp is introduced in months 2 through 12 of the policy period with the increase of Fed Funds being approximately 18 bps every month of the ramp. In this scenario, an appropriate non parallel shift in rates will OCCllI. The non parallel shift will depend on the absolute level of long-term rates (which tend to be anchored more than short- term rates), and the spread between the market and long term rates. As of Jan 2006, on average, this scenario widens the spread between the short end of the curve and the long end while raising short-term ratcs. Sccnario 3 (MHYl) widcns this spread on average in the policy period by more than Scenario 2 (ALT-5) because it widens the spread more quickly than Scenario 2. Note that the widening is on average throughout the policy period, but the final slope in the cycle we are capturing is not wider. MLYI Scenario built from the market scenario in which a - Scenario 4 Non-Parallel 200 basis point ramp is introduced in months 2 through 12 of the policy period with the decrease of Fed Funds being approximately -18 bps every month of the ramp. The shape of this curve will be changed based upon management decisions regarding a possible steepening given a rate decline. MHY2 Scenario built from the market scenario in which a +200 basis point ramp is introduced in months 1 through 12 of the next calendar year with the increase of Fed Funds being approximately 18 bps every month of the ramp. MHY2 is build like the "FW" rates and the non-parallel shift is similar to Scenario 2.

CONFIDENTIAL FCIC-134522 Restricted - F.R. FLAT Scenario in which months 2 through 60 are made to equal the rates prevailing in the 2nd month of the market rate scenario for Fed Funds. LIBOR rates in month two immediately revert to long term average spreads to funds. The Treasury Curve is held constant with month one rates. FPHYI Scenario built from the flat scenario in which a +200 basis point ramp is introduced in months 2 through 12 of the policy period with the increase of Fed Funds being approximately 18 bps every month of the ramp. The shift in the curve is parallel so that the shape of the curve remains consistent with that of the flat curve at the end of the policy period FPLYI Scenario built from the flat scenario in which a-50 basis point ramp is introduced in months 2 through 12 of the policy period with the increase of Fed Funds being approximately --4.5 bps every month of the ramp. The shift in the curve is parallel so that the shape of the curve remains consistent with that of the flat curve at the end of the policy period. FWI Market +200 scenario where the ramp begins on the first month of the next quarter after the current month of the forecast. The FW scenarios are used to forecast the migration of our policy period measured sensitivity. January of year 2 (MHY2) is skipped by the FW scenarios. The non-parallel shift in all of the FW and MHY2 scenarios is designed to mirror the "Scenario 2" methodology. FW2 Market +200 scenario where the ramp is introduced the quarter after the FWI scenario.

FW3 Market +200 scenario where the ramp is introduced the quarter after the FW2 FW4 This FW scenario is always starts the ramp in month two of the forecast. It is used to forecast reported sensitivity to a +200 in the next reporting period. Alt_l (mh300y2) Scenario built from the market scenario in which a 300 basis point ramp is introduced in months 1 through 12 of the calendar year two years after the current year with the increase of Fed Funds being approximately 27bps every month of the ramp. The shape of this curve is flattened moderately based on the advice of the BSM group and expectations of curve shape at given rate levels. Alt 2 Open scenario for ad-hoc analysis Alt_4 (last market rates) The market rate scenario used in the previous month's forecast. Used in market reconciliation. Alt_5 (m+200) Scenario built from the market scenario in which a +200 basis point ramp is introduced in months 2 through 12 of the policy period with the increase of Fed Funds being approximately 18 bps every month of the ramp. In this scenario, an appropriate non parallel shift in rates will occur. The non parallel shift will depend on the absolute level of long-term rates (which tend to be anchored more than short- term rates), and the spread between the market and long term rates. As of Jan 2006, on average, this scenario widens the spread between the short end of the curve and the long end while raising short-term 78

CONFIDENTIAL FCIC-134523 Restricted - F.R. rates. Scenario 3 (MHYl) widens this spread on average in the policy period by more than Scenario 2 (ALT-5) because it widens the spread more quickly than Scenario 2. Note that the widening is on average throughout the policy period, but the final slope in the cycle we are capturing is not wider. Alt_ 6 (bull flattener) Scenario built from the Flat Scenario in which the long end of the treasury curve is severely flattened while all shorter tenu rates remain unchanged. Alt 7 Scenario built from the market scenario in which the long end of the curve is lowered to produce a severely inverted level. This is another fonu of the bull flattener. Alt_8 (FW5) Market +200 scenario where the ramp is introduced the quarter after the FW3 scenario. Alt 9 Scenario built from the market scenario in which a 200 basis point ramp is introduced in months 2 through 12 of the policy period with the increase of Fed Funds being approximately 18 bps every month of the ramp. This scenario is currently designed to in such a way that the short end of the treasury curve fully anticipates the move by the Fed and significant widening in the spread between FF and the 2yr treasury is introduced in month two, and the 2yr to lOyr is il11l11ediately tightened. By the end of the policy period, FF has "caught up" and the spread to the 2yr treasury returns to market levels. Alt 10 Open Scenario for ad-hoc analysis

Long-term sensitivity is measured using an EVE model. The policy states that EVE measured in a flat rate environment will not decrease by more than 20% for a +/- 200 basis point shock. Current scenarios are run from -100 bps to +300 bps, though policy sensitivity is around the +200 bps shock. Production of the EVE model has not been consistent, with no model run for the 3Q05 period. Although management gives adequate focus to EVE results, it is not a primary tool for IRR measurement.

Utilization of the short-term limit increased as the balance sheet became more liability-sensitive. However, even at its most severe, the measure was managed to just -2.0% of net earnings, well within policy guidelines. Long-term utilization is more moderate. Neither has really approached breach, though. Compliance with limits is not only monitored through reporting to ALCO, but also by RM.

Risk Monitoring and Management Information Systems

Risk Measurement (ALM Modeling, Scenario Analysis/Stress Testing): Satisfactory

Risk measurement, as noted above, is completed monthly for income simulation and quarterly for EVE. The current model is RADAR but the company is nearing completion on BancWare's ALM5 model. Although output is accurate, RADAR is an outdated model that has not been supported for some time. Consequently, analysts must perform manual workarounds in several areas to fully run the model. This requires more time and energy, making the product less efficient and timely. Management clearly understands the limitations of RADAR and has adequately developed processes to address these defIciencies.

Part ofthe frustration with BancWare has been the ongoing technical weaknesses. While ALM5 could be implemented in its current form and be effective, the same workarounds as in RADAR would exist. Management is dcdicatcd to working with BancWarc to addrcss thcsc wcakncsscs so whcn implemcntcd, ALMS scrvcs all thc nccds

CONFIDENTIAL FCIC-134524 Restricted - F.R. of CFG, that it sufficiently captures all risk and optionality present on the balance sheet. Much of the input into the model will be automated, with limited manual intervention.

With this automation, reporting ability and frequency will improve. Many reports could be produced same-day or next-day as opposed to the weeks it currently takes to produce the base forecasts. Consequently, the analysts can devote more time to assessing the output and identifying key drivers. MIS should improve with greater attribution. Management has also developed a dashboard that will assist in monthly backtesting. The realignment of staff will also aid in improved analysis. CFG is being divided into two distinct groups. A portion of the staff will still be devoted to the monthly forecast, but a discretionary group that is already established will produce real-time and one-off scenarios. The monthly forecast process will not change significantly with ALM5.

Assumptions are reasonable and reviewed for appropriateness regularly. Documentation of these assumptions needs to be improved, however, evidenced by assumption changes in 3Q05 to the EVE model. Two significant changes were made, the treatment of intangible assets and lives of deposits. Intangible assets, primarily goodwill, have historically been included when determining EVE. However, with the inclusion of South Trust, EVE improved noticeably. Management decided to exclude any franchise value in the calculation of EVE and, consequently, goodwill was removed from the denominator, thereby increasing exposure to rising rates without any real change in risk profile.

In conjunction with the change in intangibles, management chose to extend its deposit lives, given the stability the company has experienced with deposit retention in recent periods. The stability is hardly surprising with liquidity levels so high across the industry. Documentation supporting the changes, especially the deposit lives, was inadequate initially. However, management addressed this and presented ALCO with sufficient analysis justifying the changes, most appropriately for the deposit betas.

Reports are backtested at the subsequent reporting period for the prior month and quarter, but management has disregarded backtesting periods beyond a year due to the continual changes at the company such as mergers. As noted earlier, a dashboard has been developed with the advent of ALM5 that should improve backtesting. We will be anxious to see the dashboard upon implementation.

Management Reporting and MIS: Satisfactory

As discussed above, management reports capture all material IRR in spite of weaknesses witl1 the current model. Although the inefficiency of RADAR is demonstrated by the numerous manual workarounds, the output accurately reflects the risk exposure of the company. This has been verified both through a 2Q05 examination and through the ALM5 implementation. Input has been thoroughly scrubbed by each analyst to ensure the new model will be a full representation of risk and as a by-product, RADAR has been verified accurate. Audit completed a review of CFG in 4Q05 that also reviewed data collection and integrity. No weaknesses were noted in that regard.

Discretion is given to CFG to determine the appropriate scenarios and information to present to senior management (ALCO). When compared with peer institutions, such as Bank of America (BAC), Wachovia reports do not provide the level of detail regularly seen in other ALCO packages. For instance, the BAC package presents several steepeners and flatteners of the yield curve, with shocks of both 100 bps and 200 bps. ALCO minutes do not reflect the desire for greater information. CFG has noted they present the scenarios they consider most relevant to the institution. The Guidelines are not explicit on which scenarios must be reported, though as noted earlier, the measures discussed in the Guidelines are not consistent with those used by CFG.

The presentation of both EAR and EVE has improved in recent quarters, largely to address comments by former CFO Kelly. The new MIS includes more visual graphics and highlights key drivers to IRR changes. These alterations have helped focus the discussion amongst senior management. Essentially, management can focus more on what the output is saying as opposed to going into detail on the formulas used to produce the MIS. Continued improvement in MIS is expected with ALM5, though it is unclear if the primary reports will change significantly.

Internal Controls and Audit 80

CONFIDENTIAL FCIC-134525 Restricted - F.R.

Model ReviewNalidation: Satisfactory

The model validation process has evolved over the past year, both with the implementation of ALM5 and the creation of a Model Validation Group assigned to assess all relevant models within the company. Historically, the validation would be co-sourced, with a consultant such as Ernst & Young performing the black box review and validating model output while Audit focuses more on overall governance ofthe process. The new process would have the Model Validation Group review the model itself while Audit opines on the control process around the model.

Due to the BankWare delays, a validation sufficient to meet OCC 2000-16 guidelines has not been performed in over a year. However, management has engaged E&Y to come in this summer to meet the minimum requirements of a black box review. Although this is not consistent with the new Model Validation Policy, management has received approval from the Model Risk Committee to outsource the validation because the Model Validation Group has limited time to validate the model prior to implementation. Going forward, CFG management will keep the Model Validation Group apprised ofthe current process and engage them for the 2007 validation. As an aside, the beta testing being done by CFG for the ALM5 model can be considered a remedial validation of BancWare's internal assumptions.

The Model Validation Group was recently created and is responsible for validating all relevant models and spreadsheets in the company. Though there is limited practical history, the group appears technically proficient and capable of meeting all validation requirements. The group resides under Market Risk Management and is independent of the business function. It is incumbent on the group to maintain an inventory of all models and document appropriate validation.

Price Testing and Control Practices: Fair

The primary drivers of this assessment are outstanding weaknesses noted at a recent audit intended to follow up on prior-year deficiencies. The November 2004 audit noted three Key Issues: Control Environment, Senior Management and ALCO Reporting, and Total Return Benchmarking.

A follow-up audit completed December 2005, rated the area as ''Needs Improvement" primarily based on a repeat key issue regarding the control environment. Specifically, the adequacy of internal reporting, a lack of straight through processing and reliance on manual workarounds and alternative control procedures were not fully addressed. Full resolution has always been expected Witll tlle implementation of BlackRock, a front office system in June 2006.

Despite the adverse rating, Internal Audit recognizes that adequate controls have been established for financial reporting. Additionally management has put in place interim controls procedures, which improve the inherent risk over complex portfolio activities. Implementation of BlackRock is on-schedule with no previously identified delays.

Formalized pricing procedures exist for the investment portfolio (as part of Balance Sheet Management Guidelines) and were most recently updated and approved by ALCO November 2005. Investments are priced by Balance Sheet Management (BSM) Operations Group on a monthly basis for internal purposes and quarterly for regulatory and financial reporting purposes. BSM reconciles the information at quarter-end and calculates the valuation adjustments (FAS 115 mark). Treasury Risk Management approves all exceptions to policy and sign-off on the quarterly valuation process.

Approximately 95% ofthe $112B investment portfolio is priced via online automated pricing tools such as IDC, EN Bloomberg, and Scandinavian Bonds (SIX). Three percent of the portfolio is valued at book value and include FRB stock, FHLB stock and Project Legion. The remaining portion represents broker quotes and more illiquid investments valued internally by STAR (internal quant group).

Internal Audit: Satisfactory

Internal audit displays the appropriate independence and can adequately assess the interest rate risk function. Members routinely attend monthly regulatory meetings and have consistently engaged management when issues arise,

CONFIDENTIAL FCIC-134526 Restricted - F.R. most notably during the BancWare implementation. The competence and stature of audit staff has improved over the past eighteen months with the addition of experienced hires.

The Asset-Liability Measurement Audit was issued February 2006, the first since early 2003, and rated IRR management satisfactory, identifying one Key Issue and three MRAs. The scope of the audit included data collection, development of assumptions and forecast, analysis and management reporting, business continuity planning, vendor management, and risk management. The findings echoed regulatory concerns noted in a 2005 examination.

Key Issue • The BancWare conversion is at risk of continued delays due to system limitations. weak project management, and staffing constraints.

Matters Requiring Attention • The process for monitoring and documenting changes in model assumptions needs enhancement. • Management review controls require formal documentation. • ALM lacks departmental policies and procedures, specifically guidance on the type and frequency of key controls needed to maintain a stable and satisfactory control environment, as well as desktop procedures that support key processes.

Clearly, management is aware of project management concerns and has worked to address them. A Treasury Project Management Policy was recently drafted with the intent to identify and monitor all significant Treasury projects. Management responded to all findings with the answer that the issues will be addressed in the new BancWare environment.

CONFIDENTIAL FCIC-134527 Restricted - F.R. Liquidity Risk

Inherent Risk

Inherent Liquidity Risk Ratings

A. Inherent Liquidity Risk:

Market Access:

Degree of Market Access: Limited

Wachovia exhibits good market access through positive debt ratings, a sound reputation, and strong investor demand. Subordinated debt spreads remain at favorable levels due to Wachovia's strong credit profile and flat yield curve. Throughout 2005 and 2006, Wachovia has approached the market regularly with a variety of structures and tenors. Total long-term debt issuance for 2005 was $6.3 Rating Agency S&P Moody's Fitch billion, all well-subscribed. This funding both Senior Unsecured A+ Aa3 AA- replaced maturing issuances and represented new Outlook Positive Stable Stable A Al A+ funding. The table below represents the various Subordinated Debt tenors for 2004-2005 issuances.

2004-2005 Debt 'Ten.ors

7,000 6,000 5,000 4,000 3,000 2,000 1,000

2 (60/0) 3 (370/0) 5 (140/0) 7 (40/0) 10 (340/0) 30 (50/0)

Waehovia uses both the bank and corporation to access the debt markets, evidenced by a $3.5 billion issuance in IQ06 of3-year floating-rate senior bank notes. Also in IQ06, Wachovia executed its WITS transaction, or Waehovia Income Trust Securities. The $2.5 billion transaction was trust-preferred securities that will convert to noncumulative perpetual preferred securities at a specific future date. The structure was relatively new to the market, in that can be

CONFIDENTIAL FCIC-134528 Restricted - F.R. included as Tier 1 capital despite its call feature. Reaction was positive with oversubscription and favorable pricing. Other financial institutions are considering similar products.

While Wachovia has adequately diversified its investor base, all issuances to date have been domestic. Consequently, management is embarking on a European "road show" in May to generate interest in what would be Wachovia's first European debt issuance. They anticipate completing the issuance in early June with another possible issuance in late 2006. The June issuance would be simple, possibly a $1 billion 5-year fixed rate offering. Remaining planned issuances for 2006 total $5.5 billion, most of which represents replacing maturing debt. Wachovia is also active in the short-term market, most notably fed funds, Eurodollars, repos, and commercial paper.

Financial Condition: Low

Wachovia is in satisfactory financial condition with no adverse issues identified in capital, asset quality, or earnings performance that would impair liquidity. The strong debt ratings represent the market's favorable view ofWachovia's financial condition. Internal regulatory ratings are:

Financial Performance Satisfactorv (2) Asset Quality Strong (1) Earnings Satisfactory (2) Capital Satisfactory (2)

Asset quality metrics have remained strong through year-end 2005 and into 1Q06, with nonperforming assets at just 0.28% oftotalloans and net charge-offs just 0.09% of average loans. These numbers are consistent with year-end metrics despite the inclusion of Westcorp. Wachovia compares favorably to peer in all traditional measures, including NPAs, net charge-offs, classified assets and criticized assets. Management does anticipate tlle level of charge-offs and NPAs to rise in 2006 due to the inclusion of Westcorp, economic factors, and frankly, little where else to go from these low levels. However, the projected increase is not signifIcant, with considerable benetIt from Wachovia's diversified portfolio. Management has made strategic improvements in portfolio management that will have a beneficial effect on risk going forward.

Based on 12/31/05 numbers

CONFIDENTIAL FCIC-134529 Restricted - F.R.

Earnings and Capital were I\et O1arge-offs'Avg. Loans rated satisfactory at the most 100 140 recent RFI assessment, with 1LD r::: I/) 000 E sound performance and r::: ::::J III 100 sufficient capital levels that 0 Off) "0 ...J 00 £ both lag peer averages. At I/) g> 040 ff) r::: year-end 2006, Wachovia's 0 « 40 net income grew 23 % over 0~ OLD LD ::2: 2004, largely on the ~ inclusion of South Trust. 000 0 Performance did suffer from LUJ4Q3 LD04Ql ;m:Q1 '2ff:Hl2. 2(UQ3 margin compression and ~NX)$--+--I\ffi'A~.lL···,··· PeerA~. higher than peer expenses, but Wachovia' s margin compression was not as NonPerforming Loans! Total Loans severe as its peers, buoyed

~ by Wachovia's diversified 1,00 1,200 <:: E business model. Low en :::s <:: 0,80 1,000 0 provisions also benefited '"0 800 () --' 0,60 performance, though 600 en 2 0.40 <:: management projects those 0 400 0 I- to double in 2006. Current 0.20 200

Wachovia remains well capitalized with Tier 1, Peer Comparison: Full-Year ROAA Total, and Leverage 2.4 E:)2004 ratios of7.50%, 2.2 10.82%, and 6.12%, 2.0 respectively at year-end 1.8 2005. These ratios have 1.6

trended downward over 1.4

the past year with 1.2

significant repurchase 1.0

activity, and the gap 0.8

between peer has 0.6 increased slightly. Nonetheless, capital BAC Citi JPMC USB WFC Peer Av. WB presents no adverse issues that would impair liquidity.

CONFIDENTIAL FCIC-134530 Restricted - F.R.

Business Activities

Balance Sheet Composition: Limited

The balance sheet composition presents WB R-B Capital Ratios & Composition limited risk characterized 100% 13.0 95% "#- 12.0 by a stable and significant 90% "#- deposit base, adequate ~ 85% 11.0 c~ lii 'is. d level of liquid assets, and 80% 8 10.0 ~ In 75% limited exposure to off Ii: ~ 9.0 '6 70% ~ balance sheet c C. 0 'E 65% B.O 8 commitments. 8. In e 60% Ii: Additionally, the parent a. 7.0 55%

company maintains liquid 50% 6.0 investments sufficient to 2004 Q1 2004 Q2 2004 Q3 2004 Q4 2005 Q1 2005 Q2 302005 402005 meet at least 12 months of =Tier 1 (excI.QTPS) ~Tier1QTPS c::::::::ITier 2 Sub-Debt & Redm Prefrd obligations. .::::::::::::::Tier 2 ALLUOther ~Tier1WB ~Tier1 Peer _Tolal R-BWB ~Total R-B Peer

Wachovia is a strong proponent of balance sheet liquidity, greatly preferring "retail deposit issuance over wholesale at any given acceptable rate," as noted in the June 2005 Liquidity Committee minutes. Although deposit growth has moderated somewhat, it remains considerable at 10.4% from lQ05 to lQ06. Core deposits represent the bulk of these deposits at $296.1 billion, or 54.6% oftotal assets, roughly static from a year earlier. Management has been able to sustain this growth while also managing pricing in a rising rate environment.

Deposit elasticity has shown to be considerable, based upon stability of deposits and the measured approach with which management has raised deposit rates. Deposit pricing strategy generally results in Wachovia rates comparing in the middle third in most markets. Management has not felt compelled to meet federal funds rate increases on a l-to-l basis, nor always match competitor pricing. Instead they rely on positive customer service metrics that indicate Wachovia is a market leader. That being said, Wachovia has benefited from BAC's mandatory reluctance to courting deposits due to the deposit cap. Now that the cap has been lifted, it is likely BAC will be more aggressive in pricing, likely requiring Wachovia to meet that aggressiveness in select markets.

The deposit mix is diversified with large core Retail Deposit Mix deposits balances in money market, demand and interest checking deposits. Increased marketing efforts to grow core CDs were successful, Savings providing longer tenor diversification. Use of broke red deposits increased slightly the last few months of 2005 but is expected to decline in 2006. Brokered deposits remain a minimal funding source.

Despite strong past performance and customer service scores, management is only forecasting additional core deposit growth of$7.9 billion through 2006, primarily in 4Q06. Based upon seasonality and market trends, management is anticipating static deposit levels through the summer with a bias toward increasing the CD deposit mix. Regional promotions have been successful in attracting retail CDs, with funds generally moving from MMDAs. Pricing strategies will vary by region, but are typically in the middle third for each market.

CONFIDENTIAL FCIC-134531 Restricted - F.R. Loan growth since lQ05 has consistently outpaced deposit growth, resulting in year-on-year growth of23.6%, most notably in consumer loans. Over that time, the loan-to-deposit ratio has gone from 76.4% to 85.5%. In spite of this, wholesale funding has remained stable at roughly 26% of total assets. Projected loan growth through 4Q06 is $14.1 billion, outpacing core deposit growth by $6.2 billion. Thus, management anticipates increased use of wholesale funding, though within policy guidelines. Management does prefer retail funding over wholesale at any reasonable cost, but as noted above, prefers not to pay leading market rates, especially when market funding remains affordable.

Management maintains a level ofliquid assets sufficient to meet a potential shortfall in cash flow. A policy minimum of$20 billion has been established and as of March 31, 2006, total liquid assets were $57.8 billion. The level ofthese assets has been stable, declining just $3.7 billion from one-year prior. In addition, unencumbered liquid assets total $43.7 billion, still well above the policy minimum. Monthly liquidity reports document total as well as short liquid assets, represented by fed funds, Eurodollar placements, reverse repos, securities borrowed and securities borrowed/matchbook. Short liquid assets represent 33.4% oftotalliquid assets. Liquidity remains in the investment portfolio as well, as noted by periodic strategic gains. However, with the rise in rates and predominance in MBS, the portfolio exhibits an unrealized loss of $1.8 billion. Due to limited portfolio turnover, this is considerably less than some peer institutions (BAC).

Management monitors contingent liabilities based upon the likelihood they will be funded. Types of commitments include conduits relating to liquidity facilities, unfunded loan commitments, TOB/lower floaters, and CDO, CREF and large loan securitizations/sales. Since lQ05, levels represent just 9% of total assets.

The parent company provides substantial support to the bank, with over $8 billion of liquid instruments on balance sheet and the ability to meet all maturing debt instruments through at least a twelve month period. As of March 31, 2006, holding company surplus funds (unencumbered OIN investments less CP outstanding) totaled $6.4 billion. Leverage levels have declined slightly, comparing below peer, while cash flow is sufficient to cover fixed charges.

Debt to Equity

Double Leverage

o 50 100 150

Source: Kevin Littler, FRS Wachovia

Wachovia compares favorably to large bank peers in other traditional measures. As noted by the far column, Wachovia is "best in peer" in most conventional UBPR ratios. Although some peer averages are skewed by outliers, comparison to primary peers (BAC, WFC, IPM) indicates a strong liquidity profile and reinforces the preference of retail funding over wholesale at any reasonable price. Liquidity Metric (12/05) WB Peer Best in Peer Based upon projections, the trend in these measures Core Dep/Assets 51.68 29.00 51.68 WD will likely move toward a less liquid profile. Many of Noncore funding/Assets 28.58 48.75 28.58 WD those projections are indicative of current market Net Noncore fund Dep. 32.75 58.39 32.75 WD -15.29 STT trends, though, and consequently Wachovia's profile in Net ST Noncore Fund Dep. 24.06 2l.55 relation to peer should remain favorable. 17.90 JPM Net Loans&Leases/Core Deposits 99.90 204.16 99.90 WB Peer: BAC, ]PM, C, Wachovia, WFC, STT, BONY,

Extent and Complexity of Off-Balance Sheet Activity: Moderate

CONFIDENTIAL FCIC-134532 Restricted - F.R. Wachovia's trading activity, while not on par with investment banks and larger peer companies, is significant and growing. For lQ06, CIB contributed 24.3% of total revenues, of which 21.7% ($372 million) resulted from trading activities. Additionally, management continues to expand volume and revenue of its complex products, as well as development of these products. Though traditionally management has targeted more mature markets, they are increasingly interested in more complex and emerging products. However, any impact from collateral calls does not present considerable concern. Management routinely monitors off-balance sheet collateral contingency for end-user and trading activity for Market + 150, +300, and -100 scenarios.

Ability to Securitize Assets: Limited

Wachovia is active in the securitization market. Wachovia regularly securitizes traditional asset classes such as home equity loans and PELs (super prime), mortgages, and auto loans. In 2005, additional asset classes included "cured" home equity loans and mortgage hybrid ARMs. Overall, management promotes securitization activities as an efficient use of the balance sheet, capital, and as a good source offee income. Recently, management decided to significantly reduce the volume of PEL securitizations for earnings reasons, only securitizing enough to maintain a market presence. Although the volume of credit card activity will likely be small in the near-term, any significant ramp-up in the business will clearly impact securitizations. Potential securitization activity is included in the contingency funding process, though alternative methods of funding are available should securitizations become restricted.

Payment Processing: Moderate

Wachovia is approaching significant participant status as defined by the "Sound Practices Paper." Wholesale and retail electronic payment channel activity is dominated by a few products: wire, ACH and debit card. For 2005, the bank processed over 1 billion ACH items and 1.1 billion debit card transactions. Additionally, Wachovia is an active CHPs user, with 50% of usage coming from international funds transfer activity. Wachovia has the capacity to effectively process all activity, making use of daylight overdrafts, though has never exceeded its net debit cap. Processes are considered sound with limited human interaction on an exception basis. Management does not anticipate significant exposure to the recent changes regarding extending intraday credit to GSEs.

Corporate Structure

Corporate Structure (for domestic institutions): Limited

There is limited complexity in the corporate structure. While the institution operates numerous nonbank subsidiaries, most of these legal entities serve as special purpose vehicles or operate under very specific investment guidelines with limited funding requirements. To limit parent company funding requirements. Wachovia consolidates most permissible activities into the bank. The parent company primarily serves as a vehicle to access debt markets and to book ineligible bank assets. Therefore limited activity is conducted outside ofthe bank, with the exception of broker/dealer, principal investing, and insurance. The broker/dealer is encouraged to self-fund or obtain external funding when possible. Funding is managed centrally out of Corporate Treasury for the parent company (including nonbanks) and the bank.

CONFIDENTIAL FCIC-134533 Restricted - F.R.

Board Governance, Structure, and Oversight: Strong

The current Board of Directors is an eighteen member group of experienced and individually successful bankers, business owners, and managers with numerous outside interests. The president of the bank is also the Chairman of the Board. The broad diversity of Board membership adds a high degree of business expertise and acumen to the leadership. The Board uses two main committees to oversee corporate risks, the Audit Committee and Risk Committee (f/k/a Credit and Finance Committee). These two groups meet bi-monthly to discuss the highest risks facing the company. The Board is viewed as capable, appropriately engaged in the management of the company, and responsive to regulatory issues.

The Board has delegated oversight of the liquidity risk function to several committees, with responsibilities narrowing down the hierarchy. The Board's Risk policy delegates oversight to the Risk Committee (RC) of the Board, comprising three non-management directors, and which further delegates risk oversight to the Senior Risk Committee (SRC) consisting of senior management. SRC oversees the risk governance structure for all risks, monitors the direction and trend of risks relative to business strategies and market conditions, and directs operational actions. The Board designates primary oversight of the liquidity risk function to the Asset/Liability Committee (ALCO).

Reports presented to the SRC and RC do not require the detail presented in ALCO reports, but do profile the risk exposure ofthe company to facilitate discussion among the highest levels of management. Limits and trends are reported. Discussions at these meetings demonstrate an engaged directorate knowledgeable enough to pinpoint key issues and risk drivers. Policies approved by the Board address the significant risk areas and assign responsibility of daily oversight to appropriate management.

Senior Management Governance, Structure, and Oversight: Strong

Senior management is well-qualified. Management displays significant experience and grasp ofthe issues facing the institution, along with experience raising wholesale funds in adverse circumstances.

Governance benefits from an active committee structure with the Asset/Liability Committee (ALCO) serving as the primary forum to discuss activities and risks associated with funding. ALCO comprises members from each division of Treasury, as well as representatives from Wachovia's business groups and risk management. Meetings are held monthly with the CFO (formerly Bob Kelly, now Tom Wurtz) as Chairman. Common discussion topics include investment portfolio activity, liquidity, interest rate sensitivity, and securitization activity.

Also reporting through ALCO is the Liquidity and Capital Committee, which meets monthly and consists of all relevant liquidity personnel, as well as the Corporate Treasurer, investment portfolio head, a senior member of the 89

CONFIDENTIAL FCIC-134534 Restricted - F.R. Corporate Forecast Group, and Risk Management. The Committee charter was recently amended to fornlally include capital. Also reporting through ALCO is the New Product Committee (NPC), recently given a more formal structure. The NPC had not met in over a year, but will meet monthly going forward.

Senior management has shown a commitment to continually improve processes and reporting. As part ofthe EFI, parent company governance was consolidated under Corporate Funding to ensure a consistent corporate strategy. Although the EFI has not progressed considerably over the past year, management remains committed and recently hired a project facilitator to meet with all appropriate parties and develop an infrastructure. A Centralized Treasury Manager is expected to be named in 2006.

In spite of the limited progress on EFI, management has developed more structure to ensure they are knowledgeable of all liquidity risks within the company. For example, a Debt Committee was recently formalized that facilitates discussion amongst the lines of business and corporate funding for all market funding activities. CIB does have the ability to access the market, but is restricted by limits and must first run such activities through the Debt Committee. Additionally, while London and Hong Kong have separate liquidity policies, there is regular discussion with the corporate function and the expectation that should liquidity be needed, it first go through Charlotte.

Risk Management is active in all Treasury committees with the Balance Sheet Management (BSM) Risk Manager acting as Secretary for most. They exhibit the appropriate influence on controls and business line activities. Management has been responsive to both audit and regulatory concerns.

New Product Approval: Fair

As noted above, the New Product Committee just recently was formalized after a year of inactivity. Though the function was inactive, there is limited concern that Wachovia has been exposed to undue risk. Complex and structured products have not historically been initiated in Treasury. However, with the advent of BlackRock, management is anticipating rolling out more new products on the investment side and therefore wanted more formalization in the NPA process. Liquidity would be included in this process, as well as complex capital structures, especially with the addition of capital under the Liquidity Committee charter.

A new NPA Charter was written detailing appropriate membership, duties, authority, and reporting. Upon initial review, the charter satisfactorily addresses regulatory guidance. Given the relative infancy ofthis process, it is premature to consider NPA satisfactory. However, should tlle charter be met, it is likely the rating will be upgraded at the next assessment. In the initial minutes, the purpose was described, "to review all investments and transactions that entail new processes that are not currently supported by Accounting, Operations, Technology, Risk Management, etc." The Committee will meet monthly and use a template for presentations. We will receive monthly minutes of the meetings.

Policies, Procedures, and Limits

Policies and Procedure: Satisfactory

The liquidity function is governed by the Balance Sheet Management Guidelines (Guidelines). The Guidelines are comprehensive, setting limits and procedures for both the bank and parent company. Policies are maintained to reflect the current risk profile of the company and limits are generally considered appropriate. The Guidelines were last approved December 2005, but were recently amended to reflect changes in the risk profile and asset size. Specific risk factors discussed in the Guidelines include internal and external liquidity sources, funding requirements, off-balance sheet liquidity exposure, exposure to specific funding sources by investor and product, overnight funding reliance, and liquid assets. Management responsibilities are also discussed in the Guidelines. These responsibilities pertain not just to daily management of liquidity, but also contingency funding events. Separate policies are maintained for the Hong Kong and London branches.

Limits and Guidelines: Satisfactory 90

CONFIDENTIAL FCIC-134535 Restricted - F.R.

Senior management has established comprehensive limits commensurate with the size and complexity of the institution. Limits are set across a broad range of liquidity risk factors, as described above. Many ofthose limits are presented in hard dollar amounts. However, management's use of absolute dollar amounts instead of ratios presents concerns for a growing company. They can become outdated quickly, do not provide useful trend analysis, and limit peer comparisons. Management does address the use of hard dollar limits in the Guidelines: "Most guideline minimums and maximums are stated as dollar amounts rather than ratios to facilitate daily management; however, these amounts are appropriately influenced by their relationship to the company's asset size as well as by market and other pertinent factors. Management will remain attuned to changes in the company's size and other factors and will recommend guideline changes to ALCO when appropriate." Furthermore, management also understands a percentage number would require better systems than currently available, with real-time capabilities, to be fully effective. Minutes do reflect discussion oflimits and their appropriateness given changes in asset size. Parent company limits are also included in the Guidelines.

Treasury is responsible for monitoring compliance with policy limits and reporting to ALCO when a limit is breached to be accompanied with an action plan to bring the limit back into compliance. While the Guidelines set hard limits, there are instances where Liquidity and Liability Management have set guidelines as well, which serve as a soft limit. One such limit is overnight borrowings. While the official limit is $25 billion, a guideline has been established at $20 billion that would initiate long-term debt issuance. A sample oflimits follows:

• Overnight Borrowing Limit $25 billion • Minimum Liguidi:ty Sumlus (Billions) Scenario One Two Three Four 30 Days $25 $15 $5 $3 90 Days $25 $15 $8 $6 180 Days $25 $15 $8 $6

• Liquid Assets $5 billion • By Product Type

Maximums ($Mil)' Scenario: One Two Three Four Overnight Fed Funds & Euros* 25,000 17,500 5,000 2,000

Term Fed Funds & Euros 15,000 10,000 7,500 5,000 Wachovia Corp Comm Paper 8,000 4,000 2,000 1,000 National Market CDs Under 1 Year 15,000 10,000 5,000 3,000 1 Year and Longer 25,000 20,000 15,000 15,000

Deposit NoteslBank Notes Under 1 Year 15,000 10,000 4,000 1,000 1 Year and Longer 30,000 20,000 15,000 10,000

Total 122,500 86,000 51,500 37,000

CONFIDENTIAL FCIC-134536 Restricted - F.R. Overnight Fed Funds & Euros Plus O/N Nat'l Mkt Comm Paper* 20,000 15,000 5,000 2,000

Additionally, parent company limits include a Net Short-Term Position (liquid resources shall be greater than potential cash calls), a Cash Capital Position (long-term funding shall be greater than illiquid assets), a SEC 3(a)(iii) Requirement (Eligible uses of commercial paper shall be greater than the total amount of commercial paper issued) and Double Leverage (:S130%). The Net Short-Term Position essentially ensures the company can meet all debt obligations within the next twelve months and is the most commonly cited measure.

Risk Monitoring and Management Information Systems

Measurement/Risk Assessment Approaches: Satisfactory

Liquidity risk metrics present the material components of risk to senior management. Primary metrics focus on overnight funding reliance, purchased funds outstanding, contingent liquidity exposure, and projected cash flows. Monthly and quarterly reporting provides management with both snapshots and trend analysis for retail and wholesale funding, including securitizations, commercial paper, and debt issuances. Additionally, forecasts are constructed for both the bank and parent company.

Quarterly, management produces contingency funding analysis, using four stress scenarios that increase in severity and are tied to the company's debt ratings. Incorporated into the scenarios are Securitization, Sale, and Financing Potential, Estimated Cash Flow for Contingent Liquidity Items, Retail Deposit Runoff Estimates, and Asset Mitigation Items. Liquidation values of most assets appear reasonable with appropriate haircuts assigned. The detail of these assumptions is included in the quarterly liquidity report.

Management Reporting and MIS: Satisfactory

As alluded to above, monthly and quarterly liquidity metrics present the material components of risk to senior management. Liquidity information is presented at several committees including, the Liquidity and Capital Planning Committee, Treasury Committee, ALCO, and the Senior Risk Committee. Additionally, management has reports that assist in daily liquidity management. While the bank's monthly and quarterly liquidity reporting is highly automated, daily monitoring and reporting is less structured and remains manually intensive. However, management recently brought in a vendor with the goal of installing software enabling management to monitor daily liquidity on a real-time basis.

Reports are produced with ample frequency for the criticality of the information. Monthly liquidity reports include the following:

• Purchased funds outstanding/Contingent Liquidity Exposure • Projected O/N and Non-O/N funding needs • Consolidated Liquidity Projection for 12 months • O/N borrowings trend • Wholesale rates, securitization activity, and forecasted deposit, equity and loan balances • Large Funds Providers

Quarterly reports provide the same information, with the addition of contingency analysis, core deposit nmoff estimates, and short-term trend analysis. These reports are produced with direct feeds from automated systems. Manual intervention in the daily reporting is required due to the constant activity and changing balances. Controls are largely in place to ensure data integrity, but occasional communication breakdowns have led to overdrafts with the Federal Reserve. Management anticipates the implementation of the Enterprise Funding Initiative will improve daily liquidity monitoring and overall communication.

Contingency Funding Plan: Satisfactory 92

CONFIDENTIAL FCIC-134537 Restricted - F.R.

Robust contingency stress analysis is perfonued quarterly at the bank level. The Guidelines thoroughly outline the responsibilities and action steps for key individuals at various stages of a stress scenario, fully integrating it into the ALCO process. However, the parent company was cited at a 1005 parent company inspection for deficient contingency planning, both for analysis and identification of key roles and responsibilities. Management has addressed many ofthese concerns and will continue to improve parent contingency funding through the EFI.

Wachovia's core stress testing involves four scenarios, each tied to downgrades in Wachovia's credit rating. There is no discussion ofthe cause of the downgrade, though this may affect the availability of certain funding. A surplus is required in each scenario. Limits have been set under each scenario and time frame, and sufficient detail and a succinct summary report as well as historic trend are reported regularly. A commercial paper (CP) issuance disruption scenario is included in the results ofthe four scenarios where the various conduits that fund via CP cannot issue while there are also draws on Wachovia-issued CP backup lines to other issuers. This impact is estimated over six months.

Management continues to improve their securitization estimates and has designed a reasonable analysis. For their worst case scenario, the new methodology looks at the widest ABS spreads during periods of economic crisis (4 standard deviations at 10/98) and increases the spread to 6 standard deviations to account for the possibility of Wachovia suffering company specific negative news while at the same time being in a poor market. A similar methodology and increased haircut is used for their second to worst-case scenario.

Much of this analysis is quantitative, based specifically on the results of the scenarios. Wachovia has consistently exceeded the minimums for these scenarios so there has been little discussion in committee minutes. Bank contingency analysis continuously goes through modifications. In the last year, management has adequately incorporated asset mitigation estimates and retail deposit runoff. It should be noted the deposit runoff estimates were originally created using historical analysis provided by the OCe. The asset mitigation projections are based on analysis done by management and incorporate estimates given by the Lines of Business. Contingency analysis is administered at a corporate level and is not addressed within the Lines of Business.

Internal Controls and Audits

Internal Audit: Satisfactory

Internal audit provides sound support to the company. Technical expertise is sufficient to assess liquidity risk management and Audit demonstrates appropriate independence. Audit's stature garners timely responses to identified weaknesses. Members from Audit attend quarterly regulator meetings and routinely engage members from the Funding group should a question arise.

The most recent Liquidity audit was completed in 3005 and rated "Satisfactory". The scope of the audit was to "evaluate the design and test the operating effectiveness of internal controls within the LLM (Liquidity and Liability Management) and Bank Funding business units". It included a review ofthe CFP, pricing procedures, Fed Account and Clearing Balance maintenance, issuance of long-tenu debt, and guideline approval and compliance.

Only one MRA was noted, a manually intensive and untimely process for monitoring funding concentrations and positions versus limits. Specifically, it related to the Large Funds Provider report. Management's response indicated a new system will be implemented by July 2006.

Counterparty Credit Risk

Counterparty Credit and Pre-settlement/Settlement Risk Management: Fair

This assessment is based largely on weaknesses noted in a 4005 examination led by the OCC that was rated "Needs Improvement". While counterparty credit risk does not pose a material risk to the institution with the volume of activity considered modest, significant technological and operational weaknesses exist.

CONFIDENTIAL FCIC-134538 Restricted - F.R. Counterparty Credit Risk Management is integrated into overall Credit Risk Management and is staffed by competent personnel. They exhibit appropriate independence and routinely monitor limit compliance, reporting through the CIB Risk-Return Committee. However, considerable limitations exist in the measurement and reporting systems, a comment noted at a 2003 examination. The lack of management to resolve these concerns in a timely fashion speaks to weaknesses in project management and possibly commitment to the overall control environment.

At the most recent examination, six MRAs were identified. They included project management, measurement and reporting systems, operations, collateral margining, credit approval processes, and staffing adequacy. The current system, STIERS, cannot capture the complexity ofthe various products that pose counterparty risk, leading to an unreliable estimate of exposure and a lack of full reconciliation to source systems. Management has recently chosen SunGard's Adaptiv system to replace STIERS and has approached the Project Management Office to ensure appropriate focus is given to the implementation. Management is confident Adaptiv is capable of meeting W achovia' s needs and is flexible enough to add products in the future.

Other concerns include: • Inadequate validation and identification for exposure calculations where Risk Factors are used • Inconsistent exception reporting (outstanding confinnations for FX spots, FX forwards, and Equity Division derivatives as well as a growing volume of unsigned confinnations) • A lack of robust margining policies to cover all product categories and articulate exception reporting procedures • Inadequate staffing levels • A comprehensive counterparty credit reserve methodology that extends beyond FX and Fixed Income derivatives.

Management has written a fonnal response to these concerns noting that enhancements to the overall process over the next 18-24 months should resolve the issues. We have not yet had fonnal meetings with management since the letter was issued, but will follow-up on these concerns as part of the ongoing supervision process.

CONFIDENTIAL FCIC-134539 Restricted - F.R.

Operational Risk

Inherent Risk

Inherent Operational Risk r----'---'---'---'---'---r'----'---'-'-- Ratings

People - Moderate

Internal & External Fraud

Complexity of financial instruments, services or processes - Moderate

Wachovia is the largest retail bank in the Southeast. As such, it offers a broad array of corporate and consumer products and services of varying complexity through many business lines such as retail banking, investment banking, retail brokerage, merchant servicing, insurance, etc. As a result, many product and service offerings have a high degree of specialization and complexity that increases the likelihood of fraudulent activities. Managing and monitoring employee activity supporting complex businesses operations across a geographical footprint this size, with significant organizational dispersion, increases inherent fraud risk.

Due to the institution's complexity of operations and increasing footprint following the SouthTrust and WestCorp mergers, plus the purchase of Union of California's international correspondent banking offices in Asia, a significant number of sensitive positions are spread throughout the world. Inherent risk has increased since 2005 with the institution's aggressive outsourcing ofthe personnel and payroll systems to Hewitt, offshoring to India of an initial group of 108 application systems -- both application development and maintenance (ADM), and offshoring of business offices processes (BPO). The increase in outsourcing and offshoring increases the risk of inappropriate access to sensitive consumer data by third-party service providers and increases the risk of contractors accessing internal (intranet) Wachovia websites where sensitive or proprietary data may not be managed on a "need to know basis".

Complexity of governance structures - Limited

From a governance and risk management perspective, the company continues to move toward greater centralization. Several executive-level risk committees that have been established in recent years are beginning to mature and exert greater influence over operational activities. Enterprise control functions such as Corporate Audit and Corporate Risk Management continue demonstrate greater stature and involvement in day-to-day operations. Over the past year, accountability, especially with respect to the progress of the IT remediation issues, has improved dramatically. Internal Audit has also been a factor in this as their identification of issues has heightened manager and staff response times to corrective actions through a more formal monitoring process. The recent merger activity has added inherent risk by increasing the footprint of the corporation throughout the US and internationally, and by adding new employees and service providers not familiar with Wachovia's governances processes and ethics.

CONFIDENTIAL FCIC-134540 Restricted - F.R. Degree of human interaction I intervention in transactions - Moderate

The company continues to use technology solutions to increase the level of automation and straight through processing (STP). Currently, transactions processed throughout the various retail and wholesale payment channels are largely completed in this manner. Human intervention is primarily on an exception basis - i.e. individual customer transactions or a payment channel file is stopped because processing criteria was not met. For the company overall, most of the payment channels are mature processes having achieved a high level of STP efficiency. A recent examination of Payment Systems Risk looked at ACH and Debit Cards and yielded a satisfactory report rating.

In other areas ofthe company, however, such as in the Corporate and Investment Bank (CIB), operational challenges have been more pronounced. These business lines rely heavily on legacy systems to process transactions or trades and evidence a much higher level of required manual intervention. In this case, the technology infrastructure on which CIB processing operates is less than effective in optimizing the efficiency gained by full STP. However, the company has recognized this situation and initiated a project aimed at improving the underlying technology infrastructure to address these issues.

Counterparty transparency - Limited

Wachovia's namc rccognition lends thc company to various fraud and thcft attcmpts, both from intcrnal and cxtcrnal sources. To date, these activities have not had a negative impact on the customer base or business client relationships. However with the significant growth of the company's correspondent banking activities, plans to re-enter the consumer credit card business following Bank of America's acquisition ofMBNA, and the added counterparty relationships that came with the acquisitions of SouthTrust and WestCorp, inherent counterparty risk is gradually increasing. Their re-entry into the credit card business means they will have more direct management and operational oversight of day-to-day credit card operations than they had working through MBNA, and the publicly-announced transition away from MBNA will encourage hackers to devise clever ways to approach Wachovia's credit card customers and attempt to deceive them into sharing their personal financial information through Internet phishing and other means.

Rmployment Practices and Workplace Safety

Employee competence - Limited

The overall level of employee competence is satisfactory. Key management positions are staffed with seasoned individuals that possess the knowledge and experience to adequately perform their job responsibilities. Management continues to improve the governance of operational and technology risk. New IT leadership over the past three years has resulted in positive changes and a renewed resolve to decisively address longstanding IT weaknesses. Key leadership changes over the past year include the Chief Financial Officer (CFO), Group Executive for Operations/Technology/eCommerce (OTE), ChiefInformation Officer for Shared Services, ChiefInformation Officer for Wachovia Securities, Director of Mainframe Security, Directory of Client Server Security, Director of Data Center Operations, and the staffing of an enterprise Offshoring and Outsourcing Management team.

Key person risk - Limited

The recent internal promotions from within ofthe new Chief Financial Officer and the Group Executive for Operations/Technology/eCommerce (OTE), illustrate Wachovia's ongoing commitment to develop depth in their management team. Where there has not been a person ready or available internally with the required skill sets, the company has successfully hired management talent from outside sources.

Staffing levels - Limited

Overall employee staffing levels are sufficient to ensure all necessary positions are filled with appropriately skilled individuals. However, in the information technology (IT) area, there are indications management's internal pool of "subject matter expert" resources is thinly stretched even with an aggressive program of outsourcing and offshoring 96

CONFIDENTIAL FCIC-134541 Restricted - F.R. technology work to India. The hiring of IBM Corporation to assist in the development and implementation of an enterprise database system that will support Basel II activities is an example of management going outside the corporation to secure key resources for important projects. However, due to the number of employees, diverse product lines, and services offered, management succession is not a concern. As discussed earlier, the company has a large pool of talented managers from which to pull future senior managers. Staffing is a common concern among all large banks striving to meet efficiency goals. However, no supervisory concern is noted yet since projects are proceeding according to schedule.

Turnover - Limited

While there was attrition associated with the SouthTmst acquisition, the level of turnover was well within anticipated margins. To date, turnover rates in connection with the WestCorp and Union of California International acquisitions coupled with the announced offshoring of application systems development and maintenance have also been within anticipated margins. Historical turnover levels have been marginal with little to no significant impact on processes. Employee morale throughout the company overall is considered good. Communication from management provides for a strong culture of information flow. Announcements of impending corporate events, such as the offshoring of information systems and business processes that would traditionally trigger a tum in employee loyalty or job satisfaction have not been a factor due in part to carefully scripted communications, employment opportunities in other positions within the institution, and fair severance programs. The company is largely viewed as an employee-friendly work place with advancement potential.

Process - Considerable

Clients, Products, and Business Practices

New or changing products or services - Limited

The company operates in a very competitive market and must quickly respond to consumer demand for new products and services. The decision to re-enter the credit card business increases overall inherent risk. However, management has historically operated as a market-follower in regard to entry into new markets, and is viewed as conservative in its merger and acquisitions strategy by seeking several niche acquisitions in known markets over large mergers in risky lines of business. Additionally, the introduction of new delivery channels for existing products or services is approached cautiously with the goal of promoting a high level of internal revenue growth through cross-selling of its full line of products and services.

Annual Growth (on/offbalance sheet). Consolidation or De Novo - Considerable

The company is adding scale and transaction volume by increasing its geographic presence beyond the Southeast US while also increasing the breadth of their products and services across multiple markets. The successful merger with SouthTrust Bank added over $50 billion to total assets and resulted in further expansion of its footprint across the southeast and Texas markets; the purchase of Union Bank of California's international correspondent banking business in Asia added over 600 offices; the acquisition of WestCorp created a Wachovia foothold on the west coast; and expanded Wachovia's market share in the automotive loans market. These mergers and acquisitions, however, lack the degree of complexity seen in the prior merger ofWachovia and First Union during 200 I and illustrate Wachovia's strategy of growth through multiple small steps over time. However, the CEO has indicated that another large-scale acquisition in the future is possible given proper conditions.

Market Competition - High

The market in which the company operates is highly competitive with several large and regional banks offering a full range of products and services both domestically and internationally. This has caused management to continually evaluate its suite of products and services for its customer base. However, management is conservative in developing new products, relies on exceptional customer service to attract and retain customers, and has developed a profitable business model.

CONFIDENTIAL FCIC-134542 Restricted - F.R.

Outsourcing / Offshoring - Considerable Vendor risk remains a key operational risk facing the company. Due to competitive pressures and cost reduction objectives, Wachovia continues to aggressively pursue outsourcing and offshoring opportunities. The fast pace which is planned for outsourcing/offshoring is what drives the considerable rating, but it is recognized that volume and level of higher risk applications moved to date is not that significant. This is a recent strategic shift for the company as management had been historically adamant about keeping IT processing in-house to maintain control over its information assets and services. Over the past twelve months, IT management has been aggressively pursuing the offshoring of application development and maintenance (ADM) work with three service providers (Infosys, Cognizant, and IBM) in India. To date 108 applications have been offshored with plans to offshore additional applications going forward. In addition, the institution is completing the outsourcing of its payroll and personnel system technology support functions to Hewitt, Inc., and Hewitt is preparing to offshore part ofWachovia's personnel and payroll workload to an India vendor with whom they have a support relationship (second level offshoring). Today ten business process operations (BPO) or functions are being test piloted in another offshoring arrangement with GenPact. Later this year and going forward, the number of business processes offshored is expected to increase substantially along with continued offshoring ofIT application development and maintenance work. Discussions with IT management indicate they are expecting to offshore/outsource up to seventy percent of their technology work (measured as fulltime equivalents or FTEs) over next few years, and management expects to offshore an as yet undetermined number of business processes.

The company is expanding its international operations through branches in London and Hong Kong, and the 600 correspondent locations it acquired from Union Bank of California. Management is placing a small contingent of employees in India to aid in the transition of offshored work.

Execution, Delivery, and Process Management

Product and Services Complexity - Moderate

Wachovia offers a wide spectrum of financial products and services. The company functions as a full-service depository services organization for retail and commercial customers, home and business mortgages, wealth management and investment banking services, debit and credit cards, ACH services, correspondent banking services, automotive loans, insurance, and a full-services securities broker/dealer organization. Through its mergers and acquisitions growth strategies, Wachovia continues to add products and services that both complement its "one-stop" shopping goals and increase the breadth and complexity of its product line. The complexity of the Corporate & Investment Banking (CIB) segment is undergoing significant technology support enhancements and process improvements aimed at strengthening internal controls and enabling existing business processes to handle larger transactional volumes as this line of business grows.

Straight through processing - Moderate Reviewer's notes: The rating was left unchanged due to the manual processes at CIB.

Wire transfer and ACH activity is largely conducted via straight through processing with only a marginal percentage of transactions requiring manual repair. Transactions processed through the various retail and wholesale payment channels are mostly automated. As would be expected for an institution this size, single customer and file transaction volumes are large across all channels. Each payment channel is independent ofthe other, thus creating additional processing complexity. Human intervention is primarily on an exception basis - i.e. individual customer transactions or a payment channel file is stopped because all straight through processing criteria was not met. Most ofthe payment channels use mature processes, having achieved a high-level of straight through processing efficiency. A recent Payment Systems Risk examination ofthe ACH and Debit card systems and risk management processes resulted in a satisfactory rating. Within the CIB trading business there has been substantially more reliance on manual transaction processing. This has been largely due to the lack of mature, integrated, and reliable applications and processes.

Volumes - Limited

CONFIDENTIAL FCIC-134543 Restricted - F.R. Wholesale and retail electronic payment channel activity is dominated by a few products: wire, ACH and debit card. Domestic and internal wire transfer activity is processed one transaction at a time. In 2005, the bank processed over 1 billion ACH items and 1.1 billion debit card transactions. Although. ACH transactions are processed throughout the day in batches, and debit card batches are processed once each evening. If transaction volumes were defined in terms of batches processes, the transaction volume numbers would be much less. Debit card transactions represent over 70% of all Wachovia retail payments. Add in ATM transactions, typically completed using the same card, and the combined transactions represent 90% of all retail activity. Early 2005 debit card transaction data indicates an approximate transaction increase of 22.5% over 2004. Regardless of how volU111e is measured, Wachovia has the capacity to effectively process all activity. Management, however, is taking action to address future capacity needs. It is expected that the disaster recovery plan that is currently being revised will the consider capacity needs with the build-out of the OX111oor data center.

Monetary Value - Moderate

Wire transfer and ACH transactions vary greatly in size from small to extremely large. As the nation's fourth largest financial institution, the volumes of these types oftransactions are large and in line with the many products and services the institution offers its retail and commercial customers. Dollar values processed are largest in wire transfer where 2005 activity, both domestic and international, amounted to 13.2 million transactions totaling $18.2 billion. ACH amounted to $2.3 trillion. Debit card activity in aggregate is sizeable ($46 billion), but minimal on a per transaction basis ($41). The failure to execute, deliver, or process within any payment channel would create temporary financial risks possibly resulting in some financial loss to the bank, with the potential for longer term reputational risk.

Systems Conversions I Integrations - Considerable

The company is frequently undertaking several systems conversionlintegration events. Whether it is integrating the systems from a recent acquisition or upgrading new platforms such as the GIL conversion, IT management usually has its hands full. Current IT systems will invariably be affected by the company outsourcing efforts. Technology management is considering offshoring and outsourcing up to 70 percent of their application development and maintenance work (measured as fulltime equivalents or FTEs) over the next few years. A comparable number has not been estimated for business processes; however as cost reduction initiatives continue to be a major part of profitability, BPO activities are expected to expand rapidly later in 2006 and subsequent years.

Systems - Considerable

Business Disruption and System Failures

Technological Complexity - Considerable

A layered series of mixed technology architectures has grown up over time adding to the complexity and the challenge of maintaining production stability and systems availability. Efforts have been underway to improve and replace some outdated systems and technology infrastructure with the result that IT systems availability service levels have increased from 99.8% in prior years to 99.9% today. This technical complexity and management's strong focus maintaining a high level of system availability is a key factor in management's ongoing attempts to define a workable strategy for using its new "0X1110or" out-of-region data center in Birmingham, Alabama. To address the current data center proximity risk, management has organized a task force of technology subject matter experts to devise a strategy that will maintain high availability and use the OX111oor facility to recover the institution quickly in the event the primary and backup data centers in Winston-Salem, North Carolina are simultaneously impacted.

Level of systems and business line interdependency - Moderate

While the company operates and manages a technology environment characterized by a disparate portfolio of technology infrastructures, applications, and reporting systems, legacy systems are generally stable. Considering the company's current IT architecture, core systems remain fairly interdependent.

CONFIDENTIAL FCIC-134544 Restricted - F.R.

Geographic Diversity - Information Technology/Operations - High

Inadequate disaster recovery capabilities have been reported as a serious control weakness by the regulators since 1999. While risk mitigation has been slow, progress is being made in reducing overall BCP risk in the company. The company's business resumption capabilities are gradually improving through greater testing rigor, the application of advanced technology solutions, and the addition of extra workspace recovery facilities through the build out ofthe Raleigh Regional Recovery Site. However, much work remains.

Reducing the time recovery gaps in the business continuity plans has been an ongoing project that has spanned several years. During 2005, management completed a significant reassessment ofBCP recovery time objectives (RTOs) to ensure consistency and appropriateness. The reassessment resulted in several applications being accorded a longer RTO thereby eliminating a majority of remaining application recovery gaps. Audit is completing a review of BCP and technology recovery capabilities with a report due by the end of second quarter, 2006. Preliminary indications are they will report the corporation's BCP and DR strategy as a "Needs Improvement" rating.

Data center risk has been a long-standing supervisory concern. Independent consultant reports also concluded that data center proximity risk is high. Corporate Risk Management in October 2004 concluded that the combination of data center proximity and business work site concentration risks are unacceptable. The Federal Reserve has been raising this concern over the past three years. We are pleased the company is constructing a third data center near Birmingham, Alabama to diversify IT production and backup resources. Construction of the new facility is scheduled to be complete on June 30, 2006. Due to cost and complex technology reasons, management's first attempt to define a long-term strategy for the new "Oxmoor" facility did not go beyond using it as a combination "data bunker and disaster recovery cold site", with the data bunker portion using asynchronous communications targeted to be operational in October, 2006. On February 17,2006, the Federal Reserve and the OCC each issued similar letters to Ken Thompson, Chairman and President ofWachovia, expressing our concern with the strategy and management's assessment that the loss of both the primary and backup data centers in Winston-Salem, North Carolina would require a minimum of 60 calendar days to procure, install, and make operational the necessary computing capacity to get the institution back in business. The letters also requested the institution reply within 90 days with a strategy that will reduce the recovery time to an acceptable level. An internal task team of subject matter experts has been assembled to develop a long-term strategy. We await management's data center strategy details and project plans to better understand how the new site will be used and how the business site concentration and proximity risks will be mitigated. Nonetheless, data center risk will not be lessened until the third center is fully operational.

Not only is there a high data center proximity risk (the primary and backup are approximately 3.5 miles apart in Winston-Salem, North Carolina), there is also a high concentration of over 10,000 business workers at Wachovia's employee Customer Information Center (CIC) in Charlotte, North Carolina, leading to the conclusion that geographic dispersion of key business functions is a recurring risk for the company.

Participation in Payments and Settlement Systems - Low

Wachovia's international funds transfer activities are managed by the Correspondent Banking Operations Group located in New York and Philadelphia. This group manages the clearing and settlement of most wholesale international payments for the company. Various technology applications are used to process payment activities including Integrated Funds Transfer (1FT) and the SWIFT Alliance payment messaging systems. Wachovia also clears and settles international payments through the Clearing House Interbank Payment Systems (CHIPS) network. The preponderance of international funds transfer processing is conducted out of New York, with sizeable offshore payments activity originating from branches in London, Taipei, and Tokyo. Most international payments are processed by Integrated Funds Transfer (1FT) system. All 1FT processing is hosted on its own separate DDA system, lIS (International Information System). Over 50 percent of the company's fund transfer volumes flow through the 1FT system.

Systemic Payments Risk - Limited

100

CONFIDENTIAL FCIC-134545 Restricted - F.R. Wachovia participates in many wholesale and retail systems with established infrastructure and controls. The company is approaching significant participant status as defined by the "Sound Practices Paper".

External Events - Moderate

Environmental Events - Moderate

Overall company exposure to environmental threats is limited. The company's center of operations is not in areas that are known to be greatly susceptible to natural disasters. In the past, the company has experienced weather-related outages due to ice storms and hurricane damage. However, these have been isolated instances. While weather always has a bearing on banking operations, no immediate or long-term problems are anticipated. The specter of an avian flu pandemic continues to grow; however, experts still predict a low probability. Should that event occur, the company could be significantly impacted in view of the large concentration of employees at its Corporate Information Center (CIC) in Charlotte, North Carolina. Due to the company's aggressive plan and actions to date to offshore to India application development and maintenance (ADM) work, and its current pilot testing often business process operations (BPO) activities to India, the risk of political instability has increased significantly. The company has a growing presence in London and Hong Kong and recently acquired from Union Bank of California its 600 international correspondent banking offices - many of which are in China, Japan, Indonesia, and neighboring countries. In addition the company has assigned a small staff of employees to live in India and manage the offshoring of systems and business functions to local service providers. The volume of offshoring of ADM and BPO activities is expected to grow rapidly over the next twelve months.

101

CONFIDENTIAL FCIC-134546 Restricted - F.R.

Operational Risk Management and Controls

Board and Senior Management Oversight - Satisfactory

Board Governance Structure & Oversight - Satisfactory

The current Board of Directors is an eighteen member group of experienced and individually successful bankers, business owners, and managers with numerous outside interests. The president of the bank is also the Chairman of the Board. The broad diversity of Board membership adds a high degree of business expertise and acumen to the leadership. The Board uses two main committees to oversee corporate risks, the Audit Committee and Risk Committee (a/k/a/ Credit and Finance Committee). These two groups meet bi-monthly to discuss the highest risks facing the company. The Board is viewed as capable, appropriately engaged in the management of the company, and responsive to regulatory issues. The company has recently followed the current best practice of electing one of the outside directors as a "Lead Director" to provide shareholders a vehicle to communicate directly with Board leadership without having to go through company management.

Management Governance & Expertise - Satisfactory

Senior management monitors and manages the affairs and risks of the company through four main committees -- the Senior Risk, Credit Risk, Market Risk, and Operational Risk Committees. The Senior Risk Committee (SRC) meets monthly and is comprised of Tier 1 managers including the President, Chief Risk Officer, and the heads of the four main business units. The General Auditor is an ex-officio member. The SRC manages and monitors the key risks in the Company and acts as an executive level management committee. The Credit Risk, Market Risk, and Operational Risk Committees actively manage all the activities ofthe Company in their respective areas. Additional risk committees exist and function beneath these four to ensure appropriate risk management across all business lines, plus effective communication and execution of corporate initiatives.

Management has taken steps over recent years that demonstrate a continuing emphasis on improving risk management. Actions include 1) establishing the Risk Committee of the Board and the Technology Risk Committee, 2) creating the corporate Operational Risk (OpR) Management Program, 3) expanding the functional oversight committees, and 4) setting higher standards for the existing risk management functions. We are beginning to observe better coordination among corporate operational risk management, business units, corporate technology risk management, and internal audit.

Basel II Oversight - Satisfactory

Board and senior management oversight of Basel II is ongoing. Audit recently rendered a less than satisfactory report on the organization, staffing, and leadership of the initial Basel compliance efforts during the first half of2005. In 102

CONFIDENTIAL FCIC-134547 Restricted - F.R. response, management reorganized the project team; new leadership was brought in; and IBM Corporation was hired to assist in developing the technology plan to design and create a Risk Data Strategy (RDS) database that will be the foundation for the Basel data analysis and reporting processes. Since then, the Audit Project Office has assigned staff to the Basel work effort to provide executive management with an objective monthly assessment of project progress and challenges. The Federal Reserve and OCC regulators are meeting monthly with audit, risk, and project management to assess progress.

The Treasury function at Wachovia has centralized oversight for Basel II preparedness through the Basel Project Management Office (PMO), and has a dedicated sponsor and a manager. In addition to the PMO, Wachovia also has a Basel II Executive Steering Committee, as well as a Basel II Stakeholder Committee. The former's scope is executive summary reporting, industry updates, and strategies, while the latter's includes many of the same items plus project strategy/scope, interdependencies, and communication. OpR and Credit risk also deal with Basel II and are discussed in their respective sections.

Performance Incentives - Satisfactory

Because ofthe size and business line diversity ofWachovia, there is no one standard model used for performance incentive programs. Currently, there is no specific methodology adopted for inclusion of operational events into performance appraisals other than where possibly human error, or failure, is reflected in an employee's performance appraisal. In particular, the company does reflect operational weaknesseslbreakdowns/errors in the evaluation of performance as needed and has a record of removing poor performers. Most performance programs are designed around targeted goals, objectives, or expectations. Generally, these are defined by the individual business units with more specific performance management factors assigned by department managers. Overall, the company has a good record of attracting and retaining qualified employees. The company's track record of maintaining a high caliber workforce is attributed to its willingness to offer competitive salary and compensation plans.

Staff Development & Training - Strong

Staff development and training is an area of strength. Wachovia was named in the Top 100 companies for developing human capital for the fourth consecutive year by Training magazine. They ranked 22 in 2004, their highest ranking yet. The company has also been recognized as having best practices for executive coaching. The Training Program is designed to strengthen employee capabilities and is largely managed within the business units. Much of the training is computer-based over the Company's Intranet and is conducted in conjunction with one of the online universities. Skill sets that can not be readily developed internally are sought externally.

New Product/Service Review - Satisfactory

There are currently six new product review committees in the Company, organized by major business unit. Additional committees have been established by the Treasury Division and Wachovia Mortgage Corporation. The charters of these committees state that the overriding objective is to " ... enable business unit leaders to make informed decisions that would introduce new products or materially alter the risks associated with existing products." Prior to introducing a product or service, the related committee(s) reviews all aspects of the plan including the associated risks and benefits.

Policies. Procedures. and Limits - Satisfactory

Operational Risk Policies and Procedures - Satisfactory

As the company continues to move from a decentralized to a centralized management model, additional enterprise wide policies and standards are being developed. Management has devoted considerable effort to standardizing information security processes, change control practices, and business continuity planning. Management has established a corporate systems development life cycle (SDLC) process that will govern all systems development activities across the company. To ensure all technology processes are governed consistently across all business lines, senior management is developing a common framework called the "IT Operating Model". This framework is based on

103

CONFIDENTIAL FCIC-134548 Restricted - F.R. "Capability Maturity Model (CMM)" concepts and establishes the necessary structures necessary for managing IT including: 1. Defining clear roles and responsibilities for decision making and accountability. 2. Identifying key capabilities associated with strategic planning, risk management, and financial management. 3. Revising and expanding existing policies and standards for relevancy and effectiveness. 4. Establishing a definitive compliance and enforcement process.

Another example of a corporate policy aimed at strengthening business ethics is the new Conflict of Interest statement. This policy was developed to reinforce employee understanding of acceptable and unacceptable business relationships. Also, the de facto policies, procedures and limits with respect to Basel II are currently issued as guidance documents.

Risk Monitoring and Management Information Systems (MIS) - Satisfactory

MIS Reporting - Satisfactory

The company is able to produce sufficient MIS to manage operational risk. The information is accurate and timely. However, much ofthis information is still assembled manually rather than generated automatically by internal systems. Such reporting is planned for but still in process of being automated. Operational risk (OpR) management's implementation plan for the corporate-wide program is progressing. By year end 2007, the plan is expected to be fully implemented and comply with all standards of Basel II. Senior management support for the program has been strong throughout its development, and evidence exists of acceptance throughout the company. The program's design includes a robust IT governance model with input from technical experts in each business line. This provides a means for information and risk data to be aggregated upward through functional risk area leaders who are senior managers in the company.

The program is being revisited to improve current processes. Elements of the capital calculation methodology have been validated but may go through further evaluation and redesign prior to full implementation. The work is expected to be completed by mid-year 2006. However, some reporting processes and policy gaps must be addressed to ensure the project moves forward. The interaction and the coordination of many corporate risk groups such as audit, OpR management, and corporate IT risk management are progressing. Also, the integration of the company's diverse infonnational databases into the Centerprise application is in progress.

Corporate Technology Risk Management was completely overhauled during 2004 with new leadership and staffing. The organization recently completed its hiring; however, it will take some time before the group implements all phases of its program. Implementing common standards and practices are in process. Risk assessment information will be used as source data for the new Centerprise database system. To date, the IT risk management group has demonstrated a reasonable capacity to identify risk and establish appropriate IT remediation requirements. In a recent examination of the IT risk management function, the OCC commended management for progress made to date, while rendering a "Needs Improvement" rating as a result of the absence of documented IT risk management policies and procedures. Other noted exceptions included infrequent reporting to executive management of the aggregate risk of all IT activities across the institution (i.e., the need to communicate clearly and concisely with executive management). In response to examination findings, IT risk management and the entire operational risk management function have implemented a clear and concise "self-assessment" reporting process that will be updated quarterly beginning with third quarter 2006 and identify the 10 to15 most significant operational risks facing each line of business, as well as the 10 to 15 most significant operational risks facing the information technology functions across the company.

Self-Assessments - Satisfactory

Business line risk assessments and relevant data capture efforts continue, and corporate communication supporting the corporate operational risk framework remains satisfactory. Although well into the implementation phase of the project, certain elements of the program remain in development. Documentation ofthe capital calculation methodology, reporting processes, and other policy gaps still need to be addressed. Risk assessments have been 104

CONFIDENTIAL FCIC-134549 Restricted - F.R. completed for the most significant areas of the company and stored in the Centerprise tool. The company is in the process of revising their analyses into more of scenario analyses where additional factors besides simply self assessments are considered.

Loss Event Data - Satisfactory

Overall, Wachovia has made good progress on loss event data collection. Wachovia has an internal loss event database and process for collecting loss event data by major line of business and event loss type. Wachovia has also been using an external database from the Operational Riskdata eXchange Association (ORX) to supplement/compliment their internal database. Although loss event data has been integrated into the operational risk economic capital (and ultimately operational risk management) process, it should be noted that it is used solely for scenario analysis and to compare against internal data. External data is not explicitly used in the operational risk economic capital model.

Bank policy require business units and support areas to record and document their operational risk losses as defined in bank regulations and by Corp Op risk management. Accordingly, all op risk losses in excess of the established thresholds are recorded in the database. Documentation is produced at the time financial impacts are recognized in the financial statements. The unit that experiences an operational loss ensures that all related loss information is approved and recorded in a complete, accurate, and timely manner. On a monthly basis, Centerprise data is verified to data provided from case management systems. Steps to further automate and improve loss data collection efforts from non GL based systems are in progress.

Wachovia is a mcmbcr of the ORX consortium and uscs ORX data for "industry" data. ORX is a not-for-profit organization owned by its members, providing members with operational risk related loss information, made anonymous by an independent custodian. Joining the ORX consortium greatly improved the quality ofWachovia's external data. Loss event data from Wachovia losses is submitted to ORX database. The characteristics of the 18 ORX members are similar to Wachovia with the portfolio size of the institution members averaging $570 billion, with $17.5 billion total revenue and 67,000 employees as of 12/31/2005.

Measurement Models - Satisfactory

Significant improvements have been made over the past year in the quantitative methods for estimating operational risk capital. Despite being a reasonable method for computing capital at the enterprise, the model is simplistic in nature and introduces components that are highly subjective. Operational risk capital is estimated at the top-of-the house and then is distributed to each business segment. The computational method for capital at the enterprise level essentially uses empirical sampling without assuming any distribution. In that sense, the methodology is unique among its peers. A bank ofWachovia's size and type typically uses some type of distribution to fit the severity of its operational losses. The model is also unique in that it does not use Monte-Carlo simulations in computing the aggregate loss distribution. The Poisson distribution is used for frequency. The loss distribution is generated using First Fourier Transform (FFT). To the best of our knowledge, no other institution has used such a method. Most peers are using a loss distribution approach (LDA).

There are three types of data that are being used in the random draw of the severity data to generate the loss distribution-historical losses, pending litigation, and the data generated out of scenario analysis. The scenario analysis uses external data and therefore there is no explicit use of external data in the model. Wachovia uses an arbitrary weighting scheme to put unequal values to different segments ofthe data. Under this scheme they can choose to ignore some amount of data of one type and put more emphasis on the data of other type out of three different types. This can result in many different capital estimates.

For the purpose of business segment allocation of capital, Wachovia uses the same method as described above to

105

CONFIDENTIAL FCIC-134550 Restricted - F.R. compute the capital at business level. The business segment capital number is computed at a 95% level whereas the top of the house capital number is computed at the 99.96% level. Although this approach produces reasonable numbers, the Model Validation and Approval group (MVA) recommended that sensitivity analysis should be performed to support the choice of the stand-alone 95 th percentile. Calculation of capital by the event types is not performed. Implicitly this is taking a full diversification benefit.

Although thc modcl was rcccntly validatcd and approvcd by MYA, somc ofthc conclusions and opinions conflictcd with those provided by examiners in late 2005. In the meantime, both examiners and members ofMVA agree that more work is needed. While there is no clear agreement in the industry on the most appropriate approach to model operational risk, MVA noted that model benchmarking should be performed in order to mitigate model risk. Accordingly, examiners will continue to monitor and evaluate work done in this area.

Internal Controls & Audits - Fair

Internal Controls - Fair

While management continues to make progress correcting longstanding IT weaknesses, the overall condition of operational controls remains fair. This rating is more driven by technology control deficiencies of the past rather than operating controls in core banking activities such as item processing, check processing, funds transfer, and deposit operations. Technology risk remediation is viewed by management as the company's highest priority. However, to fully remediate the IT control environment to an acceptable of risk will require significant effort and the completion of several on-going, multi-year projects by year end 2006.

Change control practices have varied widely across the company. Poor change control has resulted in a number system availability problems. The chief technology officer (CTO), acknowledged that change control has been a company weakness. Improper change control processes led to two significant mainframe outages in the fourth quarter of 2004. Actions are being taken to address mainframe change process weaknesses. Significant change control problems exist in the distributed systems enviro11111ent as well. This has been, and will continue to be, an industry issue for most large financial institutions because the number and type of available infrastructure systems is significant. Management launched the Distributed Systems Configuration Management (DSCM) project three years ago to establish a standard enterprise-wide process to govern change control in the distributed environment. The project is moving forward and targeted to be complete during third quarter 2006.

Corporate controls governing end-to-end systems development activities at Wachovia have not existed in the past. An enterprise SDLC allows for a more efficient IT process and consistent delivery of work. It also allows for better integration with other capabilities, such as project management, enterprise architecture, source and executable code development management, availability management, and corporate information security. As a result of a 2004 regulatory SDLC examination, management began developing a corporate SDLC governance office, a corporate strategy, and an architectural direction for SDLC process and tools. Management communicated its new enterprise SDLC process provides a framework with control points that mandate necessary approvals, and allow each application owner the flexibility to manage their own work within standardized boundaries. The policy and standards for the Enterprise SDLC were ratified in December 2004 and became effective March 31, 2005.

Information Technology - Fair

The breadth and reach of information technology systems within Wachovia are considerable. Managing technology risk across the company continues to be a significant supervisory concern. As technology-based process improvements are introduced in the marketplace, Wachovia is increasingly dependent on them to: 1. remain market competitive (i.e., redesign of their on-line banking platform and application through a project called "Sawgrass"), and 2. meet operating cost reduction goals (i.e., cost savings from offshoring IT application development and maintenance (ADM) work and supporting the offshoring of business process operations (BPO) work).

In addition, Wachovia is also building complex IT systems to collect, process, store, and report enterprise risk

106

CONFIDENTIAL FCIC-134551 Restricted - F.R. management and regulation-related data (i.e., Wachovia's SearchSpace data base that supports AntiMoney Laundering efforts, Wachovia's Risk Data Strategy (RDS) database that supports Basel II requirements, their network and application access control data base that strengthens management's control over network and system access, plus the creation of a variety of complex systems and data bases in the Corporate Investment Bank (CIE) segment that will simplify processing, improve internal controls, and increase transaction throughput).

Due to their growing dependency on IT systems, strong enterprise risk management has become a company imperative. However, management continues to struggle with controlling its complex technology enviro11111ent. The technology risk issues Wachovia faces today did not occur overnight and are the result of a confluence of historical events to include: 1. Rapid growth through mergers and acquisition 2. A historically decentralized management structure 3. Managing IT from a cost-focused perspective rather than a risk-focused perspective 4. A weak prior corporate governance framework 5. A weak IT audit function

Over the past few years, the regulators have communicated the need for management to address longstanding IT control weaknesses and IT risk reporting deficiencies. In addition, the regulators have communicated the need to strengthen both the IT Risk Management function and the Corporate IT Audit function. In 2003, executive management initiated the following multi-year IT remediation programs (all of which - except Technology Recovery are on track to be complete by 12-31-2006). 1. Access Control Program (ACP): This project focuses on ensuring that all network access into the internal Wachovia network (Intranet) is properly approved, reported, and quickly removed upon notice the worker has terminated their relationship with Wachovia. It also is focused on ensuring all application system access is properly approved, reported, and quickly removed upon notice the worker has terminated their relationship with Wachovia. 2. Information System Residual Risk Remediation (ISR3): This project focuses on improving the security tools and processes used within the Corporate Information Security (CIS) function to manage IT security. It includes upgrading firewalls, adding/upgrading intrusion detection devices, procuring software tools that identifylblock attempts by internal and external hackers to gain unauthorized access to systems and data, plus strengthening the enforcement of information security policies and procedures. 3. Database Management System Security (DBMS): This project is similar to the ACP work with the difference being it addresses unauthorized access to system databases, and places unifonll controls over who is allowed to add, change, or read data in computer databases. 4. Distributed Software Change Management (DCMS): This project speeds up the process of updating the software on distributed computer platforms as new software is released by Microsoft and other vendors. 5. Business Continuity Planning (BCP) and Technology Recovery Preparedness: This project focuses on ensuring the corporation has an effective Business Continuity Plan and an ongoing process of keeping the individual line of business plans current and tested. This project also includes the construction of an out of-region data center (i.e., "OX111oor" in Birmingham, Alabama) and the implementation of a technology recovery strategy that will ensure the institution does not go out of business if it looses both its primary and backup facilities in Winston-Salem, North Carolina at the same time.

Compared to its peers, these IT remediation projects represent basic IT internal controls. Consequently, \Vachovia's risk profile will remain behind its peers in these areas until the five IT remediation projects are complete. The supervisory team is monitoring the progress of the projects and to date we still believe these projects will be completed by 12-31-2006. This estimate does not include the OX111oor project.

Several key IT and risk governance bodies were created to provide executive oversight of these remediation projects and the IT governance process. The Senior Risk Committee and the Technology Risk Committee were established to meet these objectives. The Implementation Risk Committee was established to address issues arising out ofthe integration of new applications, systems and processes. Overall, these efforts to increase senior management oversight, strengthen executive accountability, improve project management, and upgrade risk reporting are delivering a stronger corporate IT governance process. However, while management is making progress toward a more

107

CONFIDENTIAL FCIC-134552 Restricted - F.R. disciplined and mature IT govemance structure, much work remains before operational risk is reduced to an acceptable level. Also, much of the enterprise IT remediation project work being done does not apply to the systems and technology infrastructure in the Corporate & Investment Banking (CIB) segment.

Information Security - Fair

The adequacy of the corporate information security program has been an ongoing concem for several years. Remediation plans have been underway since June 2002 to address all open issues. Because ofthe scope and size of the information security remediation undertaking, the program had to be divided into three separate project teams: ISR3, Access Control Project, and Database. Each project has a separate project manager and a dedicated team.

After a series of stops and restarts over past three years, these Corporate Information Security (CIS) projects are moving forward and expected to be complete by year end 2006. Information security residual risk assessments performed by Corporate IT Risk Management continue to show high risk until remediation efforts are complete. Findings from a November 2004, OCC examination of the Company's information security remediation process revealed the remediation efforts are improving with frequent risk assessments, better action plans, and new project organization. However, the overall condition of corporate information security risk remains high until all remediation tasks are completed and implemented. In terms ofInformation Security policies and procedures, a recent Audit rendered a less than satisfactory report based on the need for information security policies to be written with specific/clear guidance on what is and is not allowed, examples of best practices, and frequent monitoring of line of business compliance with the security policies and procedures.

Operational Risk Modeling Validation - Fair

In 3Q05, Intemal Audit engaged a Price Waterhouse Coopers subject matter expert to review the conceptual and mathematical soundness of the operational risk capital calculation model. The scope of the work was directed by Wachovia's Intemal Audit Department and was conducted at the consolidated corporate level. This review advanced validation of the development processes surrounding the economic capital methodology performed earlier in the year by Wachovia auditors. The work resulted in no serious concems with input and output of the model and the calculations were repeatable. An additional review was performed in the 4Q05 by representatives from the Market Valuation Area. The validation was performed by competent individuals in MVA that are independent of the unit responsible for developing the model (the STAR group). Minor recommendations were made with regard to development documentation in terms of version control. However, sufficient resources from the MVA group were not available to fully perform a validation in accordance with the model validation processes and procedures in MV A. Moreover, some of the validation conclusions and opinions from MY A conflicted with comments provided by examiners earlier in 2005. The govemance process over the validation process and conclusions is unclear. Based on the version control matrix for in the document it was not clear whether the validation by MY A was reviewed and approved by the appropriate oversight committee.

Accounting/Financial Controls - Satisfactory

Policies, procedures, and controls over reconciliation and financial reporting are adequate. Management continues to strengthen intemal accounting and control processes. A corporate wide financial govemance initiative was developed and implemented in late 2003. This effort was aimed at maintaining strong controls over the processes leading to accurate, timely, and transparent financial reporting. The Transaction Risk Committee, as the liaison with the business unit CFOs and their Control Managers on financial control matters, provides the necessary oversight ofthe financial govemance efforts.

The company's efforts to further develop policies more specific to transaction risk is an important part of the Sarbanes-Oxley sections 404 and 302 project. We reviewed the project office and structure of this initiative and found it to be a comprehensive approach toward ensuring compliance with the appropriate level of management support and line of business involvement. During 2005, management identified 17 significant deficiencies (10 of which are IT related), but no material weaknesses. By year end 2005, 70fthe 17 signifIcant detlciencies were remediated and

108

CONFIDENTIAL FCIC-134553 Restricted - F.R. closed, 2 new significant deficiencies were opened, and 10 of the original 17 were in process of being remediated. All of the remaining 10 are being remediated through the 4 enterprise IT remediation projects scheduled to be complete at year end 2006 (ISR3, Access Control Program, Database Security, and Distributed Software Change Management).

During April, 2006, the company successfully completed the conversion oflegacy general ledger accounting systems to the use of Oracle Financials (a suite of general ledger accounting programs licensed from Oracle Corporation). This action should bring greater consistency of process and policy across the accounting functions and improve controls.

Outsourcing / Offshoring - Fair

Wachovia has a centralized strategic sourcing function that assists line of business units in the identification, selection, and negotiation of service contracts. However with more than 3,000 outsourcing agreements (vendors) in play that involve the electronic exchange/processing of company/customer data, the responsibility for establishing reasonable service level agreements and internal controls, and managing the contractual relationship on a daily basis, becomes the responsibility of line of business management; as a consequence it is not done consistently across the company. This has been a topic of discussion by both the Corporate Internal Auditors and the regulators.

Corporate Information Security conducts security risk assessments of key third party service providers who process or exchange data electronically with Wachovia prior to contract finalization. Their results often influence the negotiations. Corporate Information Security does not routinely revisit these service providers unless there is an incident or indication that information security weaknesses exist.

Corporate Internal Audit periodically evaluates the internal controls of a few large service providers after the service contract is signed (if the contract contains Wachovia's standard "audit clause" giving them the right to conduct audits). Unfortunately, Wachovia acquired through past mergers several hundred service contracts that do not give Wachovia the right to conduct audits of the controls in place at the vendor's work site. This gap in internal control is being resolved as new contracts are negotiated with the required terms and conditions. This has been a topic of discussion by both the Corporate Internal Auditors and the regulators. However, even with the right to conduct audits, Wachovia's Corporate Internal Audit functions, and especially the IT Audit function, are not staffed with sufficient resources to visit the major service providers that process/exchange electronic data with Wachovia on anything approaching a recurring schedule - similar to the cycle approach taken for \Vachovia' s internal business functions. Thus, there is significant inherent risk associated with the electronic media service providers that is not being measured nor reported through the company's established risk management activities.

Beginning in 2005, Wachovia management made a decision to begin aggressively offshoring IT application systems development and maintenance (ADM) work to three service providers (Infosys, Cognizant, and IBM) in India. By early 2006, 108 applications had been offshored and had reached stability in the transition (means the service provider had taken ownership of the support process, was technically competent, and effectively accomplished what they were hired to do). In addition, ten business process operations (BPO) functions are being pilot tested currently with GenPact, another service provider in India. Concurrent with these offshoring activities (both of which are forecast to grow significantly this year and next), management also outsourced personnel and payroll IT support to Hewitt, Inc. and Hewitt plans to offshoring part of the work it is doing for Wachovia to yet another service provider in India. Wachovia IT management has set an arbitrary limit on outsourcing or offshoring more than 70 percent ofthe labor (measured as fulltime equivalents or FTEs) involved in the ADM work. A target is expected but has not been set for the FTEs associated with business process operations (BPO) work. The methodology used to select candidate applications for offshoring continues to evolve and improve as Wachovia gains experience in entrusting ADM work to others.

Wachovia created an enterprise offshoring management function to work with each of the lines of business during the identification, assessment, and transition of offshoring candidates. This team has assigned a person in India to manage the day-to-day relationships with GenPact while ensuring successful transitions ofBPO functional work. The methodology used to select BPO candidates for offshoring continues to evolve and improve as Wachovia gains experience in entrusting BPO work to others.

109

CONFIDENTIAL FCIC-134554 Restricted - F.R. A recent joint OCC and Federal Reserve examination ofthe govemance process over offshoring reconunended Wachovia move away from decentralized decision making on outsourcing and offshoring and focus on an aggregate assessment of outsourcing and offshoring risk to the company in total as both ADM and BPO offshoring efforts rapidly increase in number and scope across the institution. To date, this level of assessment and decision making has been made at the line of business level without regard to an enterprise policy on the total amount and type of outsourcing and offshoring risk executive management and the Board are willing to support.

Business Continuity Planning - Fair

Business continuity planning has been a high profile risk for several years and we have routinely communicated our concems to executive management. During 2005, the business functions and IT rated the criticality of each application and assigned it a "Recovery Time Objective (RTO)" rating from a high of 4 to a low of 1; systems with the highest RTO scores of 4.0 are recovered first, those with an RTO rating of3.0 second, etc.

Business units routinely conduct a Business Impact Analysis (BIA) to assist in determining the RTO ratings. While the BCP program at Wachovia is satisfactory given a single data center disruption, the BCP program does not address a wide-scale disaster that disrupts both the primary and backup data centers simultaneously as both centers are located in the same city separated by a 3.5 mile distance. An out-of-region data center is being built in Birmingham, Alabama that should be complete in mid year 2006. Unfortunately, management has found the task of separating the applications that run at the primary data center, and moving those that will keep the institution viable following the loss of both data centers in Winston-Salem, to be an extremely complex task. Management has appointed a technology task team to develop a longer range strategy and resolve this technology recovery challenge.

Annual testing of the Technology Recovery plan (restoration ofthe IT infrastructure) occurs each spring. However, the testing does not include restoring databases and applications systems, nor does it include activating user recovery sites during the same integrated test. For this reason there is risk the untested components will not perform as expected and become the weak link in a recovery event.

Insurance/Transfer Risk - Unrated

Wachovia has not defined how it is going to use insurance as a mitigant for operational risk, if at all. This is a knowledge gap and is something we will consider as the operational risk efforts continue. However, since this is a lesser priority issue it will be addressed on an informal basis through discussions with management.

Intemal / Extemal Audit - Satisfactory

Audit has incrementally improved over the past two years. Supported by senior corporate management, audit continues to communicate the desire to perform at a level consistent with its corporate goals of being one of the most admired companies in the financial services industry. Audit management continues to make progress in advancing the corporate audit program with regard to corporate stature and overall effectiveness. We are optimistic that the positive efforts seen to date will continue. Action plans instituted to address supervisory concems outside of IT Audit are progressing with the expectation that further improvement will occur over time.

The overall effectiveness of the program is closely tied to the sufficiency ofthe IT and Compliance Audit functions. We have expressed concem over the adequacy of IT audit program due in part to its approach which has been generally reactive in nature instead of proactive toward risk mitigation. Efforts to raise the credibility and stature of the audit function in the company have been adversely impacted by a less than effective IT Audit function. However, during 1Q05, we noted a change in three critical management positions that have continued to strengthen the overall function The new leadership in the IT Audit Director, Technology Services Audit Manager, and Corporate Investment Banking Technology Manager roles has brought a positive sense of focus to the function. We expect the effectiveness of the IT audit program to continue to improve as these new managers institute new processes aimed at further strengthening the audit program. Additionally, KPMG serves the company as the extemal audit group. Members of their team participate on, conduct, and oversee various intemal audits and corporate projects. Corporate 110

CONFIDENTIAL FCIC-134555 Restricted - F.R. audit management relies heavily on KPMG for support and to fill technology skill gaps where necessary. To date, KPMG has fulfilled their roles well with no supervisory concern noted.

111

CONFIDENTIAL FCIC-134556 Restricted - F.R. Legal and Compliance Risk

Inherent Risk

Inherent Risk Ratings

Inherent Risk is Considerable

Banking Businesses is Considerable:

As described in the summary above, Wachovia's size, geographic footprint, and broad product offerings continue to drive their inherent risk profile. Banking businesses include private banking, online banking (4 lh largest), limited sub prime lending activities and capital markets activities including correspondent banking.

Given some of their locations are in areas considered to be high risk geographies (High Intensity Drug Trafficking AreaslHIDTAs, High Intensity Financial Crimes AreasIHIFCAs, and potential high terrorist network geographies) they are exposed to increased money laundering activities.

Wachovia's correspondent banking business is an area they have leading market share and plan on continuing to grow. They currently have approximately 800 domestic clients and 3500 foreign customers. In 2005, they agreed to purchase UBOCI's correspondent banking business and plan on doubling revenue by the end of2007 ($500 million 2005, $750 million 2006, $1 billion 2007). This growth could come organically or through acquisition.

Lending activities at Wachovia are limited in sub-prime lending. Equibanc is a subsidiary of the bank they acquired through the South Trust merger who originates sub-prime loans primarily through broker relationships. The OCC recently reviewed fair lending at Wachovia which included a detailed review of Equibanc with satisfactory conclusions and no MRAs.

Through tlle Westcorp acquisition, Wachovia has added indirect sub prime lending (new and used) and now is the 9th largest originator with $13 billion in owned auto loans. At the time of the merger announcement, the combined auto portfolio was 22% sub prime. The OCC did not review Westcorp in their most recent fair lending review. They are targeting 2007 to allow management time to transition. OCC compliance views the quantity of risk as moderate. In addition, Wachovia also announced plans to re-enter the credit card business. Neither one of these businesses is expected to substantially increase compliance risk in 2006 but we will gather more information through our continuous monitoring program.

Capital markets activities at Wachovia have been expanding internationally. Although this increases their compliance risk profile, they are still a middle market player with small activities when compared to Citibank, Bank of America and JP Morgan. International expansion plans include real estate capital markets in Europe and Asia, corporate finance and expanded distribution activities in Hong Kong, trading and underwriting activities in London, and as previously mentioned correspondent banking.

112

CONFIDENTIAL FCIC-134557 Restricted - F.R.

Wachovia continues to face challenges related to privacylinformation security. All ofthe issues have been information security related with employee theft, loss of backup tapes, and breaches at major retailers (BJs, OfficeMax, Polo, and DSW). Further details can be found in the operational risk section and we will continue to work closely with our IT and Ops risk examiners to assess the timeliness and appropriateness of their responses to these breaches.

Given the diverse array of products offered and the amount of cross selling that occurs; conflicts of interest remain a concern.

Reg W activities at Wachovia have been consistently around 10% of capital with Wachovia Capital Markets using the most with approximately 5% of capital. In early 2005, we examined Wachovia Corporation's compliance with Reg W and had two MRAs, one related to daily aggregation of affiliate activity and one related to overdraft fees . We are currently scheduling meetings with management to verify completion of the overdraft fees MRA. The daily aggregation of affiliate activity is not scheduled to be corrected until 12/2006.

Fiduciary is Moderate:

Fiduciary business is broken down into two groups, asset management which is functionally regulated by the SEC and personal trust which is regulated by the OCe. All fiduciary businesses are underneath Wachovia National Bank, NA. The OCC continues to rate this area moderate risk in their core assessment.

The fiduciary businesses under Wachovia are housed in two divisions: Capital Management Group which contains Wachovia Securities, CMG Insurance, Retirement Services and Evergreen Asset Management and Wealth Management Group which has approximately $71.1 billion of assets and manages an additional $211 billion for Wachovia Securities, ranks as the 4th largest wealth manager in the country. Business units under Wealth Management include Wealth Markets, Personal Trust, Wachovia Insurance Services, and Ultra High Net Worth. Customers are primarily domestic and concentrated in Wachovia's retail banking footprint, however, customers are served in 49 states. Corporate and Institutional Trust businesses were sold in 2005.

Under the Capital Management Group, Wachovia has a securities lending unit with approximately $60 billion of assets that provides securities lending activities for institutional clients in the United States.

Evergreen Asset Management collectively manages $189 billion of assets with clients concentrated in the United States. As one ofthe larger business lines, it has several businesses underneath it pursuing a variety of asset management strategies. Institutional investment management is provided via separate account management while the management of mutual funds is provided through the Evergreen Funds. In addition, alternative investment strategies including hedge funds are also provided to clients.

Wachovia Securities is discussed in more detail below.

These businesses cut across the spectrum of financial services regulation. Many ofthese businesses have a distinct functional regulator and a body of rules they must comply with. For example, the different regulators include the SEC, NASD, OCC, Federal Reserve, Department of Labor, and individual state securities and insurance agencies. This myriad of regulation exposes Wachovia to compliance complexities in that they must identify rules and regulations that apply and then build effective compliance systems and protocols to monitor their business activities.

The majority ofthe legal and compliance risks involve some form of customer disclosure documents, operational processing, document retention, suitability of products recommended, and the ability ofWachovia to execute an investment strategy based on the customers risk tolerance and investment objectives. Tn addition, Wachovia must satisfy BSAIAML requirements which include KYC and CIP. This has a larger impact on the Wealth Management Group since these businesses focus on individuals instead of institutions. Lastly, the overall corporate strategy within Wachovia is to cross sell products of one division into distribution channels of another division. In many ways Capital Management Group is a "product producer" while Wealth Management Group is a "distribution platform".

113

CONFIDENTIAL FCIC-134558 Restricted - F.R. The cross selling of products introduces risk related to conflicts of interest. While conflicts of interest are not exclusive to cross selling arrangements they are at least magnified. The current regulatory environment is particularly focused on conflicts of interest and Wachovia given its size in the marketplace is subject to regulatory scrutiny in this area.

Other is Considerable:

The other rating is primarily driven by Wachovia Securities due to their leading market share in the retail brokerage business which has substantial compliance and reputation risk. The rating is not high because they are not significant players in M&A and underwriting activities.

Wachovia Securities

Wachovia Securities is currently the 3rd largest full service brokerage finn in the country with 700 brokerage offices and 10,500 registered representatives. Wachovia Securities has three distinct distribution channels: 1) full service stand alone branch offices, 2) branches located in bank offices, and 3) independently owned introducing brokerage finns which engage Wachovia Securities for securities clearing and custody services. Full service offices are spread throughout the country with eight international offices located in five Latin American countries. Offices located in bank branches are geographically dispersed throughout Wachovia' s banking footprint.

While Wachovia Securities offers a traditional set of products and services their focus is to work with "retail" clients. Given that, the product mix includes a large volume of mutual funds, fixed and variable annuities, and individual fixed income securities. While both mutual funds and annuities are not generally considered to be inherently risky from a complexity perspective, they are inherently risky from a legal and compliance perspective. These products generally require a high level of customer disclosures and can potentially expose the finn to embedded revenue sharing arrangements. These conflicts are under increased regulatory scrutiny by the Securities & Exchange Commission, NASD, New York Stock Exchange, and various state securities regulators (collectively referred to as functional regulators). In fact, many of the functional regulators are conducting so called sweep examinations to review for these activities and typically target the largest finns. These examinations can lead to fines and/or damage to the finn's reputation.

The Latin American region poses additional inherent risks to the organization. The clientele for this region includes wealt11Y individuals who are generally influential in the areas tlley live. These individuals typically want to move their assets off-shore and conceal their identities as much as possible. The primary risks are AMLIBSA related and customer identification issues.

Given the multiple regulatory agencies involved and the size and scope of the finn, Wachovia Securities is exposed to significant amount of compliance risk. The compliance department is structurally organized outside the line of business, thus providing independent representation. The compliance staff is sufficiently staffed both from a quantity aspect and from a knowledge perspective. However, increased staff turnover would pose a material risk to the organization.

Reinsurance

Wachovia operates two distinct reinsurance businesses: 1) Capital Management Reinsurance Group ("CMRG") focused on reinsuring term life insurance and fixed annuities, and 2) BluePoint Re which primarily provides reinsurance on municipal and asset backed bonds. Both entities have a very small market share and contribute an immaterial amount of revenue and profits to the holding company.

These businesses operate at a "wholesale" level as opposed to a retail driven business. As an example, CMRG's clients are other insurance companies (e.g. Aegon or Scottish Re) while BluePoint's clients are typically large reinsurers such as MBIA or FGIC.

The primary legal and compliance risks involve insurance related regulations. These are administered by the various

114

CONFIDENTIAL FCIC-134559 Restricted - F.R. states in which the insurance company conducts business. Given the transactions are between institutions, much of the insurance regulations do not apply. BluePoint Re is domiciled in Bermuda and is therefore subject to the laws and regulations imposed by the Bermuda Monetary Authority. BluePoint is prohibited from conducting any business operations within the United States.

Insurance Services

Wachovia Insurance Services is the ninth largest insurance broker who provides property casualty insurance brokerage services, risk management consulting, employee benefits and compensation consulting, life insurance, and executive benefits to clients nationwide. The various state insurance departments are the primary regulators. We are scheduled for a discovery review of insurance services in the 4th quarter. One of the goals of our review will be to establish a relationship with the NC Department ofInsurance to discuss their coverage ofWachovia Insurance Services particularly given the new AML requirements.

Private Equity

Wachovia's private equity portfolio is approximately $1.6 billion. Given its size relative to capital we do not view this as having significant compliance risk. Details ofthese activities are provided in the market risk section.

115

CONFIDENTIAL FCIC-134560 Restricted - F.R.

Risk Management and Controls

Legal and Compliance Risk Management and Controls

Overall Risk Management is Satisfactory

Board of Directors and Senior Management Oversight is Satisfactory

Banking, Fiduciary and Other:

Board Governance, Structure and Oversight - Satisfactory

The board of directors is independent and primarily comprised of outside directors. The only two directors that are employees of the Corporation are, CEO G. Kennedy Thompson and Ernest Rady who was CEO of Westcorp Financial. The board continues to approve significant policies and procedures and receives regular compliance updates through the audit committee. The board has several committees including the executive, audit, risk, corporate governance & nominating, and management resources & compensation.

The audit committee is appointed by the board of directors to assist in fulfilling their oversight responsibilities for the Corporation's compliance with legal and regulatory requirements. All members of the audit committee are independent. The committee is very active and involved and receives regular updates from the Senior Risk Committee as well as the chief compliance officer. Significant issues are raised to the board's level and the board is receiving timely and accurate information.

In addition, the risk committee is also receiving regular updates from the chief compliance officer and his staff.

Banking and Fiduciary:

Senior Management Governance, Structure and Oversight - Satisfactory

Senior management is informed of the legal, regulatory, and compliance matters by the chief compliance officer. The chief compliance officer notifies senior management through ad hoc meetings or through his involvement in the operational risk committee, chaired by Chief Risk Officer, Don Truslow. The operational risk committee is appointed by the Senior Risk Committee and is chartered to " ... assist in the oversight of operational risk and is responsible for the Operational Risk Management Program and encouraging a risk management culture throughout Wachovia Corporation."2 The committee is comprised of the Chief Risk Officer ofthe Corporation, Director of Institutional Risk Management and representatives from Loss Management, Vendor, Technology, Implementation Risk, Fiduciary, Financial, Human Capital, Business Continuity Planning, Compliance, Legal, ChiefInformation Officer, Internal audit, Technology Infrastructure, and Risk Policy.

2 Charter of the Operational Risk Committee, December 2005 116

CONFIDENTIAL FCIC-134561 Restricted - F.R. The conunittee structure at Wachovia is satisfactory and includes compliance representation. The Management Compliance Committee is chaired by Chief Compliance Officer, Bill Langley and reports to the Operational Risk Committee. The committee oversees Wachovia's risk management practices to ensure they comply with all applicable laws and regulations issued by the various federal and state regulatory agencies. This committee is comprised of senior compliance personnel and senior leaders from key support divisions.

In addition, two committees are appointed by the Management Compliance Committee; the Anti-Money Laundering Operating Committee and the Privacy Operating Committee. The Anti-Money Laundering Operating Committee " ... assists in the global oversight of effective AML risk management practices to comply with the applicable laws, rules and regulations issued by federal, state and local agencies associated with Wachovia products, services and processes."3 The committee is chaired by the BSA Officer/AML Director and is comprised of the Compliance Risk Management AML Compliance Managers and representatives of key support units (legal, corporate communications, etc.).

The Privacy Operating Committee is appointed to "champion privacy initiatives, to provide awareness to business units of privacy issues (with a particular focus on consumer privacy issues), and to identify and resolve privacy issues."4 This committee is chaired by a representative designated by the Management Compliance Committee and is comprised of compliance officers with privacy responsibilities as well as employees from key staff areas (legal, audit, corporate information security, etc.).

In addition, the Conflicts of Interest Committee is also chaired by the chief compliance officer. This committee was chartered in March of 2005 and is comprised of all line of business heads of compliance and provides oversight of the identification, recordation and resolution of conflicts of interest that exist within the Corporation. The committee has the following duties, responsibilities, and authorities as quoted directly from the Charter of the Conflict Review Committee dated December 2005:

• Provide corporate oversight for Wachovia's conflict of interest process. • Provide for a method to regularly and systematically evaluate and address conflicts of interest across the Wachovia enterprise. • Provide a forum for resolution of cross line of business conflicts of interest and act as a 'court of appeals' for such issues. • Routinely review summary reports, which is provided by the business unit compliance directors.

The c0111111ittee reports to the senior risk committee. Neither the OCC nor this Reserve Bank has reviewed the work of the committee to determine its effectiveness. This will be addressed through continuous supervision.

The compliance risk management department continues to experience no turnover in key positions. The employees in these positions are experienced, seasoned professionals who sufficiently oversee and manage the business lines compliance personnel.

Management continues to assess any gaps or staffing needs to ensure they have the appropriate resources in place. In 2005, management identified the need to add additional staffto help ensure compliance with BSA/AML. The AML office added approximately 75 new employees with other high risk lines of business (correspondent banking/London branch) adding compliance staff.

Other (Wachovia Securities):

Senior Management Governance, Structure, and Oversight - Satisfactory

Legal and compliance executives are included in the senior management structure and actively participate on the

3 Charter of the Anti-Money Laundering Operating Committee, December 2004 4 Charter of the Privacy Operating Committee, January 2005

117

CONFIDENTIAL FCIC-134562 Restricted - F.R. various committees charged with overseeing the day-to-day aspects of the business. The most important committee is the Operating Committee which is composed of the most senior level managers from across all the functional disciplines across the company. The Chief Legal Officer and the Chief Compliance Officer are both members ofthis committee. Strategic and current issues are discussed during these meetings, thus providing a forum in which legal and compliance personnel can learn of critical issues and can participate in the dialogue of these issues.

The Compliance & Legal Committee is composed of senior business managers with the primary purpose to inform senior management of current regulatory inquiries and exams, upcoming regulatory exams, discussion of exam findings, emerging regulatory issues, and litigation and arbitration issues. This committee assists senior management in addressing compliance and legal risks in the areas of business practices.

The Examination and Audit Committee is charged with reviewing all audit, regulatory and business review issues as addressed by both internal and external sources. All issues identified are reviewed, given a specific action plan, and then tracked through completion.

The New Product Committee has the responsibility for evaluating a new product or service for strategic fit and suitability versus the firm's goals, objectives, and target client audience. The committee will specifically identify the risks associated with a new product and how those risks will be mitigated and controlled.

Wachovia Securities has established many other committees which serve a variety of needs for the organization. These committees appear to be appropriate in not only variety of topical issues but also broad in functional management representation. These committees provide the forum in which management can both adjust business practices and also address personnel decisions to allocate appropriate staffing to critical areas.

Banking, Fiduciary, and Other:

Culture - Satisfactory

The Board of Directors and Senior Management continue to communicate the importance of compliance and ethics in their corporate culture. The compliance risk management department has an ethics hotline and enterprise ethics training to further reinforce the commitment.

General risk appetite is communicated to management through the corporate committee structure down to the business unit operating committees. Policies and procedures clearly define the risk limits ofthe corporation and the specific line of business. Examples include prohibited customers, countries, transactions, equity trades permitted (ClB), etc. In addition, they send out a quarterly compliance risk management newsletter to communicate any changes to risk appetite or compliance programs.

One area that Wachovia is working on is tying compliance goals to employee compensation. Currently, the performance review process does not directly incorporate compliance goals as a factor in an employee's performance review. Compliance risk management is working with human resources to add compliance goals to the performance review process. There will be one compliance goal added to all employees and multiple goals added to employees who have specific compliance duties in their job description. This is in process and is not expected to be ready until the 2007 performance review cycle.

Banking and Fiduciary:

Strength ofOverall Legal and Compliance Risk Management linvironment - Satisjactory

As described above, the board manages and understands legal and compliance risk and issues through the aforementioned committee structure. Compliance continues to be a major focus of the board and senior management. The board and senior management have an adequate understanding of the risk profile of the corporation as evidenced by the increased staffing and budget in the compliance risk management office.

118

CONFIDENTIAL FCIC-134563 Restricted - F.R.

Other (Wachovia Securities):

Strength ~fOverall Legal and Compliance Risk Management Environment - Satisfactory

Senior management possesses a solid understanding of the firm's legal and compliance risk profile. The actions of the senior management level committees are designed to capture key legal and compliance risks and incorporate risk mitigation techniques into the on-going activities of the firm. The legal and compliance departments are both sufficiently funded to provide extensive coverage in producing policies and procedures and on-going assistance to the business leaders to resolve issues as they occur. Regulatory and internally generated issues are evaluated and tracked to completion in the normal course of business.

Banking and Fiduciary:

Compliance Training - Satisfactory

All enterprise wide training for Wachovia is handled by the Compliance Risk Management department. The training program has four enterprise programs: anti-tying, AML, privacy & information security and business ethics. All customer facing employees as well as select back office personnel are required to complete AML, with all employees required to complete privacy & information security, and business ethics training annually. Business ethics was new in 2005 and was only required to be completed by managers. In 2006 all employees are required to take and complete the business ethics module. Enterprise wide training is administered via online modules through My Learning Connection ({iJ Wachovia with an assessment at the end. In addition to the modules, Wachovia does provide face to face training as needed.

Wachovia has made a concerted effort to develop in house AML training customized to specific lines of business. In 2005, an employee was added in the AML office to specifically develop and continually improve AML training. Outside of the corporate version, training modules exist for the General Bank, Capital and Wealth Management, Wachovia Securities, and Corporate Investment Bank (CIB). Three new modules were developed for specific departments inside of CIB and include treasury services, global financial institutions (correspondent banking), and London branch.

In addition, the AML office has developed a one day training course called the AML Academy. This is designed to supplement the required training and provide an in depth review of AML. Initially, this is planned to be rolled out in May to employees with AML specific responsibilities with a roll out to all employees planned for the future.

Training requirements were also implemented for employees of offshore companies Wachovia is utilizing. These employees are required to go through new hire orientation which includes AML training. These employees will also be required to complete AML training annually.

The individual lines of business are still doing their own customized training in addition to the enterprise programs. Certain lines of business have additional training modules required by their functional regulator (NASD, NYSE) that would be handled on a local level. This training is accomplished through face to face meetings or online modules.

Currently, completion of training is not tied to compensation packages of employees. Senior management is working with human resources and legal to examine tying compensation to the completion of the training program. This is expected to be implemented for the 2006 training plan.

Other (Wachovia Securities):

Compliance Training - Strong

In addition to required corporate training described above, Wachovia Securities is required under both NASD and NYSE rules to provide comprehensive and tailored training programs to all securities licensed employees. These

119

CONFIDENTIAL FCIC-134564 Restricted - F.R. programs include both industry and finn element specific issues. Results ofthese training programs are recorded and submitted to the NASD and NYSE. Employee compensation and perfonnance evaluations are impacted if an employee fails to meet required training elements. In fact, the employee's securities license may be suspended or tenninated if the employee fails to complete the annual required training requirements.

In addition to the regulatory required training elements, Wachovia Securities provides additional compliance training tailored to the specific needs ofthe organization. These programs tend to be fonnal and involve multiple delivery fonnats e.g. in-person, computer based, etc.

Banking, Fiduciary and Other:

New Product Approval - Satisfactory

New products are approved through a committee structure for each of the five major business segments, Corporate and Investment Banking, Capital Management Group, the General Bank Group, Wachovia Mortgage, and Wealth Management. The primary focus ofthe committee is to identify the risks associated with a new product and how these risks will be mitigated and controlled. Each committee is comprised ofthe business segment chief financial officer, chief risk officer, chief infonnation officer, compliance director, and deputy general counsel, or their designees. The committee also includes the human resources director, operational risk manager and representatives from treasury and tax as ex officio members. Market risk management and international risk management are invited if the new product is deemed to have market or international risk. The definition of new products is clearly defined as well as the process around the submission and approval of new products. Legal and compliance personnel are voting members ofthe committee and have ample opportunity to comment before the new product is approved. If compliance and the business line disagree, the decision is escalated to the chief compliance officer and line of business head. If disagreement continues, the chief risk officer will make the decision for the corporation. Although we have not directly tested the process and documentation, we are comfortable that it is effective and appropriate through our discussions with management.

Policies, Procedures, and Limits are Satisfactory

Banking and Fiduciary:

Legal and Compliance Policies and Procedures - Satisfactory

The policies and procedures are adequate and have shown very few deficiencies when examined by this office, the OCC and internal audit. Corporate level compliance risk policies and procedures include BSA/AML, anti-tying, privacy and regulation O. In addition to corporate level policies, each line of business has policy and procedure manuals specific to their business. Any changes to the corporate wide policies must be submitted to the compliance risk management department for review and approval. Policies and procedures can never be below the minimum corporate standard but may need to be enhanced given risks inherent in certain lines of business. The policies and procedures are updated as necessary, reviewed by senior management, and approved by the Board of Directors. As part of their quarterly self-assessment process, line compliance is required to evaluate policies and procedures for effectiveness and new regulations which would require changes to policies. Independent ofline compliance and the quarterly self assessments, internal audit tests policies and procedures as part of their audit program.

Other (Wachovia Securities):

Legal and Compliance Policies and Procedures - Satisfactory

Wachovia Securities has designed compliance policies and procedures that are comprehensive, regularly reviewed, and approved by senior management. The various regulatory agencies which supervise the brokerage industry have instituted certain requirements mandating policies and procedures and requiring evidence of controls verified by the president of the brokerage finn. As required by the regulators certain areas ofWachovia Securities may be more 120

CONFIDENTIAL FCIC-134565 Restricted - F.R. proscriptive than others.

Risk Monitoring and Management Information Systems are Satisfactory

Ranking, Fiduciary, and Other:

Legal and Compliance Risk Monitoring Capabilities - Satisfactory

The compliance risk management department is responsible for the risk monitoring/MIS of the corporation. Outside of the committee structure previously described, the compliance risk management department monitors business risks aligned with the corporation's lines of business which include Capital Management Group and Wealth Management Group, General Banking Group and Specialty Finance, and Corporate and Investment Banking. They also monitor corporate functional areas which include privacy, AML, ethics, and regulation O. The legal department has also assigned attorneys who work closely with compliance. This structure is independent, comprehensive, and allows for the timely identification of compliance risks and emerging issues.

Banking, Fiduciary, and Other:

Litigation Risk Management Practices - Satisfactory

Wachovia's litigation department will not provide their reserve calculation methodology as they believe this waives their attorney client privilege. Their reserve methodology does take into consideration the expected outcome with the expected dollar amount. This calculation is done with the operational risk team. The total number of lawsuits pending against the corporation has remained stable with approximately 1200 active cases and no major settlements.

Banking and Fiduciary:

Control SelfAssessments and Compliance Risk Assessments - Satisfactory

The chief compliance officer and his direct reports (line of business heads of compliance) compile a quarterly stoplight report which assesses and reports the major legal and compliance risks in each business line. Each business unit compliance professional is required to complete a quarterly self-assessment survey that assesses compliance with regulations as well as the processes in their business units. They also report current and emerging compliance riskslissues. After completion, business unit compliance will submit their assessments to corporate risk management with a rating (high, moderate, low) where they are vetted in the management compliance committee and input into the stoplight report.

Annually every business unit is required to assess compliance risk. This is done by listing regulations/regulatory requirements and risk ranking them (high, moderate, low). Once completed this is used to set the monitoring and testing plan.

Compliance risk management has a quality assurance process in place to review the quality and adequacy of the annual and quarterly risk assessments. A report is generated to the business unit that lists issues and areas of improvement, ifnecessary. No ratings are given in these reports. We have not reviewed this area and as a result have a knowledge gap. Our monitoring and testing review will gather more information on the quality assurance process.

Any compliance issues that need to be tracked for remediation are input into the issues tracking database. The database tracks self-identified, internal audit, external audit, and regulatory issues/findings. Business unit compliance with compliance risk management oversight will input the issues in the database. The compliance risk management department will monitor the progress and send reminders. Issues can only be closed by a designated employee in compliance risk management and not by business unit compliance. This database is part of the operational risk management system Centerprise. This database and the processes were implemented in the 1st quarter of 2006. The chief compliance officer is intending on adding KRIs to the system in the 3rd quarter. Given it is a new database and process we will monitor its etlectiveness through ongoing supervision. 121

CONFIDENTIAL FCIC-134566 Restricted - F.R.

Other (Wachovia Securities):

Control SelfAssessments and Control Risk Assessments - Strong

In addition to the above described quarterly and annual self assessments, the NASD and NYSE rules and regulations require Wachovia Securities to perform branch office audits. These audits are comprehensive in nature and include applicable laws and regulations as well as internal policies.

Banking, Fiduciary, and Other:

Board and Senior Management Reporting - Satisfactory

The stoplight report is provided to the various regulators and presented to the Operational Committee which includes the Chief Risk Officer, the Senior Risk Committee chaired by the CEO as well as the Audit Committee ofthe Board. In addition to the quarterly stoplight report, the chief compliance officer presents his annual report of compliance to the Senior Risk Committee and the Board of Directors.

Although the stoplight report includes the AML office in its assessment, the board of directors is provided with a bimonthly update compiled and presented by the AML officer and the chief compliance officer. Promontory in its review ofWachovia's AML compliance recommended that the board reporting of suspicious activity be changed from the fraud investigations unit to the AML officer. They also recommended that enhancements be made to the reporting to provide more detail and better MIS reporting to include business unit specific information. The report was enhanced in the 4th quarter of 2005 and includes an update on key events internal and external, legal and regulatory matters, examination summary (internal audit, various regulators), suspicious activity monitoring, OFAC reporting, and AML training.

The General Counsel ofthe Legal department provides a report of litigation to the Board every two months. The report details all cases they deem "significant" along with their status and potential $ exposure. Wachovia considers three criteria in determining whether a lawsuit is "significant": -exposure at $5million or greater -equitable type relief that may impact business -potential for substantial publicity (media) He also provides an update on any regulatory actions pending against the corporation.

Banking, Fiduciary, and Other:

Monitoring Practices - Satisfactory

As described above, monitoring practices at Wachovia are adequate and independent. This summer (early August) we will be reviewing the monitoring and testing practices to determine the robustness and confirm the independence and adequacy. This will include a review of the annual and quarterly self assessment process that feeds the stoplight report as well as the reporting process to the board and senior management.

Banking, Fiduciary, and Other:

Systems and Automation Tools - Satisfactory

Many systems and tools are utilized by the business unit as well as the compliance risk management department to monitor and manage legal and compliance risk. Both groups work closely with their technology partners with internal audit independently testing their effectiveness and alignment with policies and procedures. One major area of

122

CONFIDENTIAL FCIC-134567 Restricted - F.R. deficiency was related to their monitoring systems for BSA/AML. They did not have an enterprise automated transaction monitoring system in place until 2005.

Searchspace was implemented in July of 2005 with phase II implemented in December. As an enterprise wide automated transaction monitoring system, it was implemented to improve the effectiveness oftheir AMLIBSA monitoring, investigations and reporting. As part of the implementation process, internal audit and regulators were provided regular updates and IT staff verified all systems were captured and included in the Searchspace data feeds. In addition, Searchspace conducted a test phase to ensure that the system inputs were providing the expected outputs. Given its newness, the system is currently generating alerts that go to investigation 5% of the time. Wachovia has dedicated a team ofIT employees who continually tune the system monthly to improve its effectiveness. The tuning process involves reviewing the alerts that went to investigation compared to the alerts that did not go to investigation to determine if they need to adjust the inputs. They also have discussions about the alerts generated with compliance and the Financial Investigative Unit (review Searchspace alerts) as part oftheir process. Searchspace and Wachovia's goal is to have 10% of the alerts going to investigation. In addition to the tuning process, Wachovia is enhancing the system by designing business logic units (BLUs) which will generate alerts based on rules designed by business unit compliance.

The issues tracking database is described above and was recently implemented into their processes. This database is housed in Centerprise which is an operational risk system. Centerprise is described more fully in the operational risk section.

Internal Controls and Audits are Satisfactory

Banking, Fiduciary, and Other:

Legal and Compliance Internal Controls - Satisfactory

The system of internal controls sufficiently covers the legal and compliance risks of all business units within Wachovia Corporation. The process is independent from the business line as evidenced by their reporting lines. Internal audit coverage is satisfactory and management provides internal audit with access to information and tracks findings until completed.

Banking, Fiduciary, and Other:

Reporting Lines - Strong

Wachovia's compliance function is independent of the lines of business. The Compliance Risk Management (CRM) department consists of all compliance heads of the major lines of business who report directly to the chief compliance officer, Bill Langley. The chief compliance officer reports to senior risk officer, Don Truslow who reports to the CEO. Each major line of business also has an employee from the legal department to assist them with legal, compliance, and regulatory issues.

Banking, Fiduciary, and Other:

Review and Testing Practices - Satisfactory

Compliance testing is done by the line of business compliance staff. The testing program is derived from the annual and quarterly risk assessments. They assess the legal and compliance risk to the particular business unit and report the results to the management compliance committee who then decides what is included in the quarterly stoplight report. Internal audit tests this process when they audit the compliance risk management department (CRM). We will be looking at compliance testing as part of our monitoring and testing review.

The AML Office created an AML Risk Assessment Team in 2005. This team is responsible for quantifying the level of money laundering risk present in the organization by evaluating the various lines of business and AML related 123

CONFIDENTIAL FCIC-134568 Restricted - F.R. processes. They annually assess the risk ofthe different business entities in each ofthe major lines of business. After they complete their risk assessment they test the high risk business units, high risk global issues and other areas of concern for compliance with regulatory requirements. This team began testing in the 3rd quarter of 2005. The OCC reviewed the risk assessment team in the 3rd quarter and rated it satisfactory. We will need to assess the robustness of their testing.

Banking, Fiduciary, and Other:

Audit - Satisfactory

Internal audit for compliance was rated fair and is now considered satisfactory. This is largely due to enhancements made in their BSA/AML audit program. In 2005, a compliance audit team was created with their main responsibilities to coordinate audit's three year compliance plan, oversee enterprise wide compliance audits and provide regular reporting to audit leadership and the FED/OCC. They also created centrally defined scopes for AML and Privacy audits providing the required minimum standards that are built on by the line of business audit staff. In addition, they were also involved in various enterprise wide regulatory and Compliance Risk Management audits which included business line BSA/AML segment audits (GBG, CIB, WMG, CMG), the AML office, privacy, and compliance risk management. Other compliance audits are done by the audit team assigned to the business unit. Internal audit aligns their teams with the various business units which include Wealth Management Group/Capital Management Group, Capital and Investment Banking, General Banking Group, Risk Management, Technology, Finance, and Human Resources/Corporate Relations. Annually internal audit prepares a risk assessment for each business entity which incorporates compliance laws and regulations. They are then rated as high, medium, and low risk with the audit testing schedule determined by the rating. High risk units are audited annually, medium risk every two years and low risk every three years. In addition, the compliance audit team completes an AML risk assessment on each business entity. The same rating system and testing schedule is utilized. Coverage, frequency, scopes, and management responses are appropriate and the audit committee of the board is updated on all compliance audits.

One area the compliance audit team is working on is increasing their bench strength in BSA/AML auditors. This is being done to ensure the quality of B SAlAML audits regardless of turnover not due to inadequate staffing levels or expenence. Management is designating current staff members that will receive additional internal and external training.

124

CONFIDENTIAL FCIC-134569 Restricted - F.R.

IV. Risk Matrices and Institutional Overview Appendix Items

2006 Risk Matrices

Overall

• Inherent Risk Assessment

Consolidated Inherent Risk Ratings

• Risk Management Assessment

Consolidated Risk Management and Controls Summary

125

CONFIDENTIAL FCIC-134570 Restricted - F.R.

Credit Risk Assessment

• Inherent Risk Assessment

Inherent Credit Risk Ratings

• Risk Management Assessment

126

CONFIDENTIAL FCIC-134571 Restricted - F.R. Market Risk Assessment

• Inherent Risk Assessment

Inherent Market Risk Ratings

• Risk Management Assessment

Banking Book Market Risk Managetnent and Controls

127

CONFIDENTIAL FCIC-134572 Restricted - F.R. Trading Book Market Risk Managetnent and Controls

128

CONFIDENTIAL FCIC-134573 Restricted - F.R. Liquidity Risk Assessment

• Inherent Risk Assessment

Inherent Liquidity Risk Ratings

• Risk Management Assessment

Liquidity Risk Managelllent and Controls

129

CONFIDENTIAL FCIC-134574 Restricted - F.R. Operational Risk Assessment

• Inherent Risk Assessment

• Risk Management Assessment

Operational Risk

130

CONFIDENTIAL FCIC-134575 Restricted - F.R. Legal and Compliance Risk Assessment

• Inherent Risk Assessment

Inherent Risk Ratings

• Risk Management Assessment

Legal and COInpliance Risk Managetnent and ~ Controls

131

CONFIDENTIAL FCIC-134576 Restricted - F.R.

Appendix Items (Business Line Management)

Divisional Management Division Leadership Team Position General Bank: Ben Jenkins Head of the General Bank Steve Boehm Wachovia Card Services / Merger Projects Bob Burton Rctail Crcdit Products Tom Coley Southern Banking Group > Guy Bodine Texas > Robert Hoak Mid South > Bob Helms Florida > Bill Linginfelter Georgia Reggie Davis Northern Banking Group > Jim Cherry Mid -Atlantic > Hugh Long Penn/Del > Walter McDowell Carolinas > Mike Slocum Atlantic Glen Eubanks Real Estate Financial Services Carol Evans Wholesale Banking Bill Holt Community Banking Bob McGee Chief Administrative Officer David Pope Business Banking Cece Sutton Retail Banking Gwynne Whitley Corporate Customer Service Excellence Jon Witter General Bank Distribution Capital Management David Carroll Head of Capital Management Dennis Ferro Evergreen Investments Darryl Fluhme Corporate & Institutional Trust Danny Ludeman Wachovia Securities Bob Reid Retail Investment Products Emile Shahadi Finance C.I.B. Steve Cummings Head of Corporate & Investment Banking Ranjana Clark Treasury Services Michael Heavener International Dave Pitelka Finance Wayne Robinson Capital Finance Kevin Roche Investment Banking Bill Taggart Chief operating Officer Ben Williams Global Capital Markets Wealth Management Stan Kelly Head of Wealth Management Linda Bowden Managing Executive > Anne Alexander Florida, Texas > Jeff Hartman Mid -Atlantic > John Lotz Alabama > Curt farmer Carolinas > Antoinette Cooper Atlantic > Sherry Pailet Penn/Del > Lisa Simington Georgia Morrison Creech Credit & Deposit Services Anne Doss Wealth Management Services Mary Mack Wachovia Client Partnership Glenn McCoy Chief Financial Officer 132

CONFIDENTIAL FCIC-134577 Restricted - F ·R . Stewart McDowell Wachovia Insurance Services Bob Newell Wachovia Trust Dan Prickett Managing Executive, Calibre Operations Jerry Enos Head of Operations, Technology & eCommerce Gloria Chance eCommerce Martin Davis Corporate CIO Jim Ditmore Chief technology Officer Risk Management Don Truslow Head of Risk management Bill Dawson Wealth and Capital Management Groups Jeanne Dornbos Chief Financial Officer David Gaines CIB Talal Hamadah Market Risk Bill Langley Compliance Risk Mark Midkiff General Bank Russ Playford Credit Risk Y ousef Valine Operational Risk Finance Tom Wurtz Chief Financial Officer and Head of Finance Bob bertges Corporate Real Estate Ginny Hartsema Staff Group CFO David Julian Corporate Accounting & Reporting Alice Lehman Investor Relations Ann Prock Corporate Financial Services Pat Shevlin Corporate Tax TBF Treasury & Planning Legal Mark Treanor General Counsel and Head of Legal Hal Clarke Capital Management Group Doug Edwards Litigation Donna Harris Corporate Regulatory and Securities Rebecca Henderson Credit Risk Management and Operations Joe Long Wealth Management Mark Metz General Bank and Specialty Finance Jay Powers Corporate and Investment Banking Vince Randazzo Public Policy Sterling Spainhour Corporate Services HR / Corp. Relations Shannon McFayden Head of Human Resources and Corporate Relations Jim Esposito CIB David Furman General Bank Larry Gilmer Compensation & Benefits Peggy Joines Wealth Management Hector McEachern Corporate Businesses Jill Olmstead Leadership practices Sharon Smart Enterprise Services Doug Steele Capital Management Group Scott Wells Outsourcing Bob DeAngelis Customer Analysis, Research and Targeting Jim Garrity Corporate Marketing Ginny Mackin Corporate Communications Mike Rizer Communitv Relations

133

CONFIDENTIAL FCIC-134578 Restricted - F.R.

134

CONFIDENTIAL FCIC-134579